> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft SQL Server Connector

> Connect SQL Server as a source or destination in Zwiron, including CDC.

Zwiron supports Microsoft SQL Server 2016+ (and Azure SQL Database) as both a source and destination, with CDC via SQL Server's built-in Change Data Capture feature.

***

## Connection details

| Field    | Description                                  |
| -------- | -------------------------------------------- |
| Host     | Hostname or IP of your SQL Server instance   |
| Port     | Default: `1433`                              |
| Database | The database name                            |
| Username | SQL Server login                             |
| Password | Login password                               |
| Instance | Named instance (optional, e.g. `SQLEXPRESS`) |
| Encrypt  | Enable TLS encryption (`true` recommended)   |

***

## Permissions

### Source (read-only)

```sql theme={null}
CREATE LOGIN zwiron WITH PASSWORD = 'your_password';
CREATE USER zwiron FOR LOGIN zwiron;
GRANT SELECT ON SCHEMA::dbo TO zwiron;
```

### Destination (read-write)

```sql theme={null}
GRANT SELECT, INSERT, UPDATE, DELETE, ALTER ON SCHEMA::dbo TO zwiron;
```

### CDC

CDC must be enabled at the database and table level:

```sql theme={null}
-- Enable CDC on the database
EXEC sys.sp_cdc_enable_db;

-- Enable CDC on each table
EXEC sys.sp_cdc_enable_table
  @source_schema = 'dbo',
  @source_name   = 'your_table',
  @role_name     = NULL;

-- Grant CDC read access
GRANT SELECT ON SCHEMA::cdc TO zwiron;
```

**Supported sync modes:** Full Refresh ✅ | Incremental ✅ | CDC ✅

***

## Azure SQL Database

When connecting to **Azure SQL Database** (hostnames ending in `.database.windows.net`), you must whitelist the IP address that will make the connection before it can be established. Azure's firewall silently drops packets from non-whitelisted addresses, which causes the test connection to hang and time out.

### Which IP do I whitelist?

This depends on which execution mode you are using:

**Agent mode (self-hosted agent)**

The connection originates from the machine where your Zwiron agent is installed. Find its public IP by running this on the agent machine:

```bash theme={null}
curl -s https://ifconfig.me
```

Whitelist that IP in your database's firewall rules.

**Hosted mode (no agent)**

The connection originates from Zwiron's cloud servers. Whitelist **all** of [Zwiron's static egress IPs](/concepts/network-access) — every unique HA address, not just one.

### Whitelisting your agent's IP (Agent mode)

1. Find your agent machine's public IP:
   ```bash theme={null}
   curl -s https://ifconfig.me
   ```
2. In the [Azure Portal](https://portal.azure.com), open your **SQL server** (not the database).
3. Go to **Security → Networking**.
4. Under **Firewall rules**, click **Add a firewall rule**.
5. Enter the IP address from step 1.
6. Click **Save**.

### Common error: connection timed out

If you see **"The connection timed out"** or **"Connection failed"** during the test, the most likely cause is a missing firewall rule. Add your agent's IP as described above and retry.