Connector guide
Connect Microsoft SQL Server safely
Encrypted access through a dedicated database reader
1. Create a contained read-only user
Create a dedicated login or contained user, grant CONNECT, and grant SELECT only on curated schemas. Avoid broad server roles and db_owner.
2. Restrict network and authentication
- Require encrypted transport and validate the server certificate.
- Prefer a private endpoint or tightly scoped firewall rule.
- Keep production and non-production identities separate.
3. Expose only approved data
- Expose curated views in a reporting schema.
- Do not add the identity to db_datawriter, db_ddladmin, or server roles.
- Use column permissions or views to exclude sensitive fields.
4. Verify before connecting
- Verify effective permissions before connecting.
- Confirm cross-database access is disabled.
- Test bounded schema-qualified SELECT queries.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.