System Requirements for Azure SQL Instance

Verify that your environment meets the system requirements for Azure SQL instance.

Azure Cloud

• Verify that the following ports are open on the computer that has access to the Azure cloud:

  • 443 to management.azure.com

  • 1433 to *.database.windows.net

    Note

    Depending on your Azure environment, you might need to open additional ports. For more information, see Granting access to Azure SQL Database and SQL Data Warehouse in the Microsoft documentation.

  • 22, on the access node computer with Red Hat Enterprise Linux operating system.

• Verify that the Azure setup is using public clouds only.

  Note

  Sovereign clouds, such as in Germany or China, are not supported. For more information, go to Azure Regions Decision Guide in the Microsoft documentation.

On-Premises Access Nodes

• If the client accesses Azure through an access node, then the user that runs the Commvault services must have the access node settings configured through Internet Explorer. If the Commvault services run under a local system account, then perform the following steps to set the access node settings:

  1. To open a command window with the local system account, run the following command:

      
     psexec.exe -i -s -d cmd.exe 

  2. To confirm the user account, run the following command:

      
     whoami.exe

  3. To set the proxy server, run the following command:

      
     iexplore.exe 

• For restoring an on-premises backup to the Azure cloud:

  • Install SQL Server on the access node.

    The operating system of the access node can be either Windows or Red Hat Enterprise Linux.

  • Verify that the SQL server on the proxy client has the most recent SQL version so that the proxy server is in sync with the Azure instance.

    Note

    Azure always has the most recent SQL version.

Operating System

Linux

For information about SQL Server on Linux, see Microsoft guidelines for SQL Server on Linux on the Microsoft website.

Windows

Allow Resources To Communicate for Backup And Restore Operations

If the staging path (DacFx) method is not used, the Azure resources, such as the SQL instance, must have the “Allow Azure services and resources to access this server” option enabled in order for these resources to be allowed to communicate for backup and restore operations. For more information about this option, go to "Import Export Service" on the Microsoft Azure website.

SQL Server User Accounts and Authentication

This section describes the supported user accounts and authentication methods for Azure SQL Database.

Azure SQL Database supports the following types of user accounts for data protection:

• Azure SQL Server Admin account: Serves as the server administrator for the Azure SQL instance.

• Microsoft Entra Password: Manages user accounts, security settings, and permissions for users who access the Azure SQL Database.

  • Ensure that login names for user accounts are in UPN (User Principal Name) format.

    Note

    Multifactor authentication is not supported.

  • Install the Microsoft Active Directory Authentication Library (ADAL) for Microsoft SQL Server or SQL Server Management Studio (SSMS) on the access node.

• Database user: A database-level account used to configure minimal permissions for data protection operations. This authentication type requires the following minimum permissions:

  Server-Level Roles	Database-Level Roles
  None	db_owner on the database being backed up dbmanager on the master database This role is required to delete the temporary transactionally consistent database copy during the backup operation and is required for the restore operation to create the database.

The following authentication methods are supported:

• Microsoft Entra Managed Identity: Provides a secure, credential-less method for Azure resources to authenticate and authorize with other services that support Microsoft Entra authentication.

  Both system-assigned and user-assigned managed identities are supported.

  For more information, see Enabling Microsoft Entra Managed Identity Authentication.

• Microsoft Entra Service Principal: Provides a secure method to authenticate and access Azure SQL resources without using individual user credentials.

  For more information, see Enabling Microsoft Entra Service Principal Authentication.

Supported TLS Version

The software supports database protection operations on TLS version 1.2.