30/07/2026, 12:23 Securing SQL Server - SQL Server | Microsoft Learn
Securing SQL Server
Applies to: SQL Server
Securing SQL Server can be viewed as a series of steps, involving four areas: the platform,
authentication, objects (including data), and applications that access the system. This article
guides you through creating and implementing an effective security plan.
You can find more information about SQL Server security at SQL Server security best practices.
This includes a best practice guide and a security checklist. Be sure to install the latest service
pack or cumulative update.
Platform and network security
The platform for SQL Server includes the physical hardware and networking systems connecting
clients to the database servers, and the binary files that are used to process database requests.
Physical security
Best practices for physical security strictly limit access to the physical server and hardware
components. For example, use locked rooms with restricted access for the database server
hardware and networking devices. In addition, limit access to back up media by storing it at a
secure offsite location.
Implementing physical network security starts with keeping unauthorized users off the network.
For more information, see SQL Server security best practices - Infrastructure threats.
Operating system security
Operating system service packs and upgrades include important security enhancements. Apply
all updates and upgrades to the operating system after you test them with the database
applications.
Firewalls also provide effective ways to implement security. Logically, a firewall is a separator or
restrictor of network traffic, which can be configured to enforce your organization's data security
policy. If you use a firewall, you increase security at the operating system level by providing a
chokepoint where your security measures can be focused. The following table contains more
information about how to use a firewall with SQL Server.
[Link] 1/6
30/07/2026, 12:23 Securing SQL Server - SQL Server | Microsoft Learn
ﾉ Expand table
For information about See
Configuring a firewall to work with SQL Server Configure a Windows Firewall for
Database Engine Access
Configuring a firewall to work with Integration Services Integration Services Service (SSIS
Service)
Configuring a firewall to work with Analysis Services Configure the Windows Firewall to
Allow Analysis Services Access
Opening specific ports on a firewall to enable access to SQL Configure the Windows Firewall to
Server Allow SQL Server Access
Configuring support for Extended Protection for Authentication Connect to the Database Engine Using
by using channel binding and service binding Extended Protection
Surface area reduction is a security measure that involves stopping or disabling unused
components. Surface area reduction helps improve security by providing fewer avenues for
potential attacks on a system. The key to limiting the surface area of SQL Server includes running
required services that have "least privilege" by granting services and users only the appropriate
rights. The following table contains more information about services and system access.
ﾉ Expand table
For information about See
Services required for SQL Server Configure Windows Service Accounts and Permissions
If your SQL Server system uses Internet Information Services (IIS), additional steps are required to
help secure the surface of the platform. The following table contains information about SQL
Server and Internet Information Services.
ﾉ Expand table
For information about See
IIS security with SQL Server Compact Securing SQL Server - Operating system security
Reporting Services Authentication Authentication in Reporting Services
SQL Server Compact and IIS access Internet Information Services Security Flowchart
SQL Server operating system files security
[Link] 2/6
30/07/2026, 12:23 Securing SQL Server - SQL Server | Microsoft Learn
SQL Server uses operating system files for operation and data storage. Best practices for file
security require that you restrict access to these files. The following table contains information
about these files.
ﾉ Expand table
For information about See
SQL Server program files File Locations for Default and Named Instances of SQL Server
SQL Server service packs and upgrades provide enhanced security. To determine the latest
available service pack available for SQL Server, see the SQL Server Web site.
You can use the following script to determine the service pack installed on the system.
SQL
SELECT CONVERT(char(20), SERVERPROPERTY('productlevel'));
Principals and database object security
Principals are the individuals, groups, and processes granted access to SQL Server. "Securables"
are the server, database, and objects the database contains. Each has a set of permissions that
can be configured to help reduce the SQL Server surface area. The following table contains
information about principals and securables.
ﾉ Expand table
For information about See
Server and database users, roles, and processes Principals (Database Engine)
Server and database objects security Securables
The SQL Server security hierarchy Permissions Hierarchy (Database Engine)
Encryption and certificates
Encryption doesn't solve access control problems. However, it enhances security by limiting data
loss even in the rare occurrence that access controls are bypassed. For example, if the database
host computer is misconfigured and a malicious user obtains sensitive data, such as credit card
[Link] 3/6
30/07/2026, 12:23 Securing SQL Server - SQL Server | Microsoft Learn
numbers, that stolen information might be useless if it's encrypted. The following table contains
more information about encryption in SQL Server.
ﾉ Expand table
For information about See
The encryption hierarchy in SQL Encryption Hierarchy
Server
Implementing secure Enable Encrypted Connections to the Database Engine (SQL Server
connections Configuration Manager)
Encryption functions Cryptographic Functions (Transact-SQL)
Certificates are software "keys" shared between two servers that enable secure communications
by way of strong authentication. You can create and use certificates in SQL Server to enhance
object and connection security. The following table contains information about how to use
certificates with SQL Server.
ﾉ Expand table
For information about See
Creating a certificate for use by SQL CREATE CERTIFICATE (Transact-SQL)
Server
Using a certificate with database Use Certificates for a Database Mirroring Endpoint (Transact-
mirroring SQL)
Application security
Client programs
SQL Server security best practices include writing secure client applications. For more information
about how to help secure client applications at the networking layer, see Client Network
Configuration.
Windows Defender Application Control (WDAC)
Windows Defender Application Control (WDAC) prevents unauthorized code execution. WDAC is
effective way to mitigate the threat of executable file-based malware. For more information, see
to Windows Defender Application Control documentation.
[Link] 4/6
30/07/2026, 12:23 Securing SQL Server - SQL Server | Microsoft Learn
SQL Server security tools, utilities, views, and functions
SQL Server provides tools, utilities, views, and functions that can be used to configure and
administer security.
SQL Server security tools and utilities
The following table contains information about SQL Server tools and utilities that you can use to
configure and administer security.
ﾉ Expand table
For information about See
Connecting to, configuring, and controlling SQL Server Use SQL Server Management Studio
Connecting to SQL Server and running queries at the Sqlcmd Utility
command prompt
Network configuration and control for SQL Server SQL Server Configuration Manager
Enabling and disabling features by using Policy-Based Administer Servers by Using Policy-Based
Management Management
Manipulating symmetric keys for a report server Rskeymgmt Utility (SSRS)
SQL Server security catalog views and functions
The Database Engine exposes security information in several views and functions that are
optimized for performance and utility. The following table contains information about security
views and functions.
ﾉ Expand table
For information about See
SQL Server security catalog views, which return information about Security Catalog Views
database-level and server-level permissions, principals, roles, and so on. In (Transact-SQL)
addition, there are catalog views that provide information about encryption
keys, certificates, and credentials.
SQL Server security functions, which return information about the current Security Functions (Transact-
user, permissions and schemas. SQL)
SQL Server security dynamic management views. Security-Related Dynamic
Management Views and
[Link] 5/6
30/07/2026, 12:23 Securing SQL Server - SQL Server | Microsoft Learn
For information about See
Functions (Transact-SQL)
Related content
Security considerations for a SQL Server installation
Security for SQL Server Database Engine and Azure SQL Database
SQL Server 2012 Security Best Practices - Operational and Administrative Tasks
Playbook for addressing common security requirements with Azure SQL Database and
Azure SQL Managed Instance
SQL Server Security Blog
Security Best Practice and Label Security Whitepapers
Row-level security
Protecting Your SQL Server Intellectual Property
Last updated on 01/26/2026
[Link] 6/6