Auto Discover Azure SQL Databases

Automatically identify Azure SQL database instances in a Subscription or Management Group for JIT access management

Apono’s Auto Discovery feature identifies tagged Azure SQL database instances, including MySQL and PostgreSQL. Rather than integrating each instance individually, you can integrate selected databases and their resources at once during your Azure Subscription or Azure Management Group setup.

This capability requires network access to each discoverable database. If your databases are in different Azure networks, make sure to create an Azure connector for each network.

Since Auto Discovery uses Azure Resource Graph, direct database access is not required for the initial discovery.

---

Prerequisites

Item	Description
Apono Connector	One or more Apono connectors for Azure with network access to your Azure SQL databases Minimum Required Version: 1.3.6 Follow these steps to update an existing connector.
Azure Permissions	Permissions to complete the following tasks in your Azure instance: Create and manage Azure Key Vault secrets Tag Azure resources Access to your Azure Subscription or Azure Management Group instance

---

Enable Auto Discovery

Follow these steps to enable Auto Discovery:

1. In your Azure SQL database, create a user for the Apono connector. As part of this step, you will also create a secret.

   • Azure MySQL

   • Azure PostgreSQL

2. Tag your database instance based on the authentication method you selected in the previous step. In the table below, the values shown in italics are the exact text you should enter when adding these tags.

Key	Value or Description
vault-url	URL of the Azure Key Vault containing the secret Example: https://mystore.vault.azure.net/
secret-name	Name of the secret in Azure Key Vault Example: db-credentials

1. In the Apono UI, on the Catalog tab, click Azure. The Connect Integrations Group page appears.

2. Under Discovery, click Azure Management Group or Azure Subscription.

3. Under Connect Sub Integration, select Database, Table, and Role to control the granularity of discovery in each discovered instance. \

   

   Azure SQL instances under Connect Sub Integration
4. Complete the Azure Management or Azure Subscription integration (steps 3-10).

After connecting your Azure Management or Azure Subscription to Apono, you will be redirected to the Connected tab to view your integrations. The new Azure integration, along with sub-integrations for each database instance, initialize during the first data fetch. The integration becomes Active once the process completes.

Now that you have completed this integration, you can create access flows that grant permission to your Azure SQL database resources.

---

Troubleshooting

If SQL database instances appear with errors on your Integrations page, follow these steps:

1. Check Tags: Verify all required tags are present and correctly formatted.

2. Connector Permissions: Ensure the Apono connector has necessary permissions to read tags and access secrets.

3. Network connectivity: Ensure each SQL database instance is accessible by an Apono connector within the same network.

For any questions about the discovery process, please contact Apono Support.