Azure SQL

When a database alert fires, you need answers fast. OpenSRE connects to your Azure SQL instances to quickly diagnose what’s going wrong — checking server health, finding those slow queries that are bogging things down, monitoring resource usage, and analyzing query execution plans to pinpoint bottlenecks.

What you’ll need

Before getting started, make sure you have:

An Azure SQL Database instance up and running
Network connectivity from your OpenSRE environment to your Azure SQL server
Database credentials ready (username and password)
Your server hostname handy

Getting connected

The easy way: Interactive setup

If you prefer guided steps, just run:

opensre integrations setup

Pick Azure SQL from the menu and follow the prompts.

The flexible way: Environment variables

Add these to your .env file:

AZURE_SQL_SERVER=myserver.database.windows.net
AZURE_SQL_DATABASE=mydb
AZURE_SQL_USERNAME=sqladmin
AZURE_SQL_PASSWORD=your_password
AZURE_SQL_ENCRYPT=true

Variable	Default	Description
`AZURE_SQL_SERVER`	—	Required. Azure SQL server hostname
`AZURE_SQL_DATABASE`	—	Required. Database name
`AZURE_SQL_USERNAME`	—	Required. SQL authentication username
`AZURE_SQL_PASSWORD`	—	Required. SQL authentication password
`AZURE_SQL_ENCRYPT`	`true`	Encrypt your connection for security
`AZURE_SQL_PORT`	`1433`	SQL Server port
`AZURE_SQL_DRIVER`	`ODBC Driver 18 for SQL Server`	ODBC driver name

The permanent way: Integration store

You can also save your connection details to ~/.opensre/integrations.json:

{
  "version": 1,
  "integrations": [
    {
      "id": "azure-sql-prod",
      "service": "azure_sql",
      "status": "active",
      "credentials": {
        "server": "myserver.database.windows.net",
        "database": "mydb",
        "username": "sqladmin",
        "password": "your_password",
        "encrypt": true
      }
    }
  ]
}

Finding your connection details

Your Azure SQL server hostname looks like myserver.database.windows.net. You can find it:

Open the Azure Portal
Navigate to your SQL Database resource
Look for Server name in the overview panel
Copy it and add .database.windows.net if needed

Network access: Firewall setup

Azure SQL uses firewall rules to control who can connect. Make sure OpenSRE can reach your server:

In Azure Portal, go to your SQL server → Security → Firewalls and virtual networks
Add your OpenSRE environment’s IP address
Or check Allow Azure services and resources to access this server if running in Azure

If you’re not sure of your IP, start with a permissive rule temporarily, get OpenSRE working, then lock it down.

Investigation tools

When OpenSRE investigates an Azure SQL-related alert, these diagnostic tools are available:

Server status

Retrieves service tier, resource utilization, connection counts, and database size. Useful for spotting DTU or vCore throttling.

Current queries

Lists active sessions and running queries to identify lock contention or long-running operations.

Slow queries

Surfaces top resource-consuming queries from Query Store or DMVs to pinpoint performance regressions.

Wait stats

Reports cumulative wait types to identify I/O, lock, or CPU bottlenecks.

Resource stats

Returns CPU, memory, and I/O utilization metrics for the target database.

Test the connection

Ready to verify everything works?

opensre integrations verify azure_sql

Expected output:

Service: azure_sql
Status: passed
Detail: Connected to Azure SQL Database ...

Troubleshooting

Symptom	Fix
Connection timeout	Add your OpenSRE IP to the Azure SQL firewall rules.
Login failed	Confirm `AZURE_SQL_USERNAME` and `AZURE_SQL_PASSWORD`. Check that SQL authentication is enabled on the server.
SSL/certificate error	Keep `AZURE_SQL_ENCRYPT=true`. Install the correct ODBC driver (`ODBC Driver 18 for SQL Server`).
Permission denied on DMVs	Grant `VIEW SERVER STATE` and `VIEW DATABASE STATE` to the OpenSRE user.

Security best practices

Use a dedicated read-only SQL user for OpenSRE — avoid admin credentials.
Keep encryption enabled (AZURE_SQL_ENCRYPT=true) in production.
Restrict firewall rules to the OpenSRE environment’s egress IP.
Store credentials in .env or the integration store, never in source code.

Overview

LLM providers

Observability and incidents

Cloud, code, and collaboration

Messaging

Data and workflow systems

What you’ll need

Getting connected

The easy way: Interactive setup

The flexible way: Environment variables

The permanent way: Integration store

Finding your connection details

Network access: Firewall setup

Investigation tools

Server status

Current queries

Slow queries

Wait stats

Resource stats

Test the connection

Troubleshooting

Security best practices

​What you’ll need

​Getting connected

​The easy way: Interactive setup

​The flexible way: Environment variables

​The permanent way: Integration store

​Finding your connection details

​Network access: Firewall setup

​Investigation tools

​Server status

​Current queries

​Slow queries

​Wait stats

​Resource stats

​Test the connection

​Troubleshooting

​Security best practices

What you’ll need

Getting connected

The easy way: Interactive setup

The flexible way: Environment variables

The permanent way: Integration store

Finding your connection details

Network access: Firewall setup

Investigation tools

Server status

Current queries

Slow queries

Wait stats

Resource stats

Test the connection

Troubleshooting

Security best practices