SQL Server and Azure SQL

Keel connects with Microsoft.Data.SqlClient using ApplicationIntent=ReadOnly.

Read-only role script

-- Run in the source database as an administrator, then use keel_reader in Keel.
CREATE LOGIN keel_reader WITH PASSWORD = 'Choose-a-strong-passw0rd';
CREATE USER keel_reader FOR LOGIN keel_reader;
ALTER ROLE db_datareader ADD MEMBER keel_reader;
GRANT VIEW DEFINITION TO keel_reader;
-- Optional, for usage-based inference: Query Store.
GRANT VIEW DATABASE STATE TO keel_reader;

Before you run it:

• Run it in the source database. On Azure SQL Database run CREATE LOGIN in master and the rest in the source database (or use a contained user: CREATE USER keel_reader WITH PASSWORD = ...).
• db_datareader reads every table of the database; for fewer schemas, grant SELECT ON SCHEMA::sales instead and narrow Schemas in scope.
• VIEW DEFINITION lets Keel read keys, indexes and view text. VIEW DATABASE STATE is optional (Query Store, for usage-based inference).

In Keel

Sources › Connect source › SQL Server: Host, port (1433), database, user and password; TLS and "trust server certificate" options. Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Run against SQL Server 2022 in CI and Azure SQL Edge on arm64 machines: the new login passes Test connection, harvests and profiles, and is refused an INSERT and a CREATE TABLE. See Connect sources.