Reference · built on requestConnectorDatabases & warehouses

Azure SQL Database

Tables, change data capture, and change tracking from Azure SQL Database over TDS, plus server management through the Azure REST API.

Request accessPricing ↗

About

Azure SQL Database is Microsoft's platform-as-a-service database built on the SQL Server engine, reached at <server>.database.windows.net through a gateway on port 1433. A connection policy of Redirect sends traffic straight to the node on ports 11000 to 11999; Proxy keeps it on the gateway. Change data capture works without SQL Server Agent: a scheduler inside the database runs capture every 20 seconds and cleanup every hour. Change tracking, server-level firewall rules, and Microsoft Entra authentication carry over from SQL Server with Azure-specific limits.

An operator on Fibric reads your tables and change feeds and proposes T-SQL row changes or firewall rule updates for your approval, each with a receipt and an undo.

This is a reference listing. It documents what Fibric would read from Azure SQL Database and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Rows from tables the principal can SELECT, over any TDS driver: Microsoft.Data.SqlClient, ODBC, JDBC, Node.js, Python, Go
  • Change table rows per capture instance from cdc.fn_cdc_get_all_changes_ and, where @supports_net_changes = 1, cdc.fn_cdc_get_net_changes_
  • Capture health from sys.dm_cdc_log_scan_sessions and sys.dm_cdc_errors
  • Change tracking deltas from CHANGETABLE(CHANGES ...), validated against CHANGE_TRACKING_MIN_VALID_VERSION()
  • Server-level IP firewall rules from sys.firewall_rules in master and the Azure REST API firewall-rules list
  • Whether CDC is on, from is_cdc_enabled in sys.databases and is_tracked_by_cdc in sys.tables

Proposed actions

  • Target capability: propose an UPDATE or INSERT in T-SQL against a table you name, once, after approval
  • Target capability: propose a server-level IP firewall rule through sp_set_firewall_rule or the Azure REST API firewall-rules create-or-update
  • Target capability: propose enabling a capture instance with sys.sp_cdc_enable_table and a @captured_column_list limited to the columns you need

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Pull order changes without polling the app database

    Enable a capture instance on the orders table with net changes and read the delta each cycle, so a status flip reaches the operator after the scheduler's next 20-second scan.

    With Order Risk, Promise Date

  • Watch for cost drift from CDC log growth

    Track log throughput and change table sizes per database and flag when scan or cleanup falls behind the workload.

    With Cost Anomaly, Storage Growth

  • Keep the firewall list honest

    Read sys.firewall_rules, compare it with your allowlist, and propose the rule to add or remove, including the 0.0.0.0 AllowAllWindowsAzureIps rule if it is on.

    With Access Review

Requirements

  • A logical server with a firewall rule for the connector's address, or a private endpoint; outbound TCP 1433 and, for Redirect, 11000 to 11999
  • For CDC, a vCore-tier database or DTU tier S3 or higher; Basic, S0, S1, and S2 are not supported
  • db_owner to enable CDC; readers of a change table need SELECT on all captured columns and membership in any gating role set by @role_name
  • A Microsoft Entra administrator set on the server if the connector signs in with a managed identity
Authentication
SQL authentication or Microsoft Entra authentication; for services, a managed identity (user-assigned or system-assigned) or a Microsoft Entra service principal with a client secret, created in the database with CREATE USER ... FROM EXTERNAL PROVIDER.

Limits

  • Capture and cleanup cadence cannot be changed; pollinginterval and continuous do not apply, and Microsoft gives no SLA for when changes reach change tables
  • Enabling CDC disables the aggressive log truncation of Accelerated Database Recovery, so log use rises and a larger compute size may be needed
  • Online index operations are unsupported while CDC is enabled on the database (error 18773)
  • A paused serverless database does not run CDC; the scan resumes only when the database resumes

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Azure SQL Database ↗

Questions and answers

Does Azure SQL Database need SQL Server Agent for CDC?
No. A change data capture scheduler inside the database replaces the Agent jobs. The capture job runs every 20 seconds and cleanup every hour; you can trigger them by hand with sp_cdc_scan and sp_cdc_cleanup_change_tables, but you cannot change their frequency.
Which ports must be open?
TCP 1433 to the regional gateway for every connection. Clients inside Azure default to the Redirect policy and also need 11000 to 11999 to the database node; clients outside Azure default to Proxy and stay on 1433. The DAC needs 1434 and 14000 to 14999.
How does a service sign in without a password?
With a managed identity. Create it as a database principal with CREATE USER [name] FROM EXTERNAL PROVIDER, then connect with a token from an Azure Identity library. A Microsoft Entra administrator must be set on the server first; removing that admin disables all Entra connections.
Ask about Azure SQL Database

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Azure SQL Database through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy