Docs / SQL Server

Connect SQL Server

Microsoft relational database

SQL Server connects over the TDS protocol with an ordinary login. The setup below creates a login that belongs to db_datareader and nothing else, so the account can read every table and view and modify none of them.

Credentials

Host
Hostname or IP, for example sqlserver.example.com. For a named instance use host\instance_name.
Port
1433 unless you have changed it.
Database
The database to query, for example analytics.
Username
The read-only login created below.
Password
That login’s password.

Before you start

SQL Server Authentication must be enabled — Mixed Mode — because climpt is not a Windows client and cannot use integrated authentication.

Creating a read-only login

Run these in SSMS or sqlcmd as an administrator.

1 · Server-level login

CREATE LOGIN climpt_readonly
WITH PASSWORD = 'strong_password_here',
     CHECK_POLICY = ON,
     CHECK_EXPIRATION = ON;

2 · Database user and read role

USE analytics;

CREATE USER climpt_readonly FOR LOGIN climpt_readonly;
ALTER ROLE db_datareader ADD MEMBER climpt_readonly;

-- Optional: allows schema introspection
GRANT VIEW DEFINITION TO climpt_readonly;

db_datareader grants SELECT on every table and view in the database and nothing more — no INSERT, UPDATE or DELETE. If you want tighter scope, skip the role and grant SELECT on specific schemas instead.

Network and encryption

  • Turn on Force Encryption in SQL Server Configuration Manager so connections cannot fall back to plaintext.
  • Open port 1433 only to the addresses that need it.
  • Confirm the SQL Server Browser service is running if you use a named instance.

Managed SQL Server

Every statement above works unchanged; only the network configuration moves into the provider’s console.

  • Azure SQL Database — firewall rules in the Azure portal. TLS is enforced by default.
  • Azure SQL Managed Instance — virtual network, or a public endpoint with NSG rules.
  • AWS RDS for SQL Server — security groups, plus encryption in transit.
  • Google Cloud SQL for SQL Server — authorized networks, with SSL supported.

Worth knowing

  • SQL Server uses square brackets for identifiers: [my-table].
  • CHECK_POLICY = ON applies your Windows password complexity rules to the login; CHECK_EXPIRATION = ON enforces rotation.
  • Rotate the password roughly every 90 days.