1. Working with Azure SQL DB

2. About PASS
The PASS community encompasses everyone who uses the Microsoft SQL Server or Business Intelligence Platforms. This includes database administrators, application developers, Business Intelligence professionals, information technology professionals, executives, consultants, educators, instructors, and students.
The Professional Association for SQL Server (PASS) is the only independent, user- run, not-for-profit association dedicated to the SQL Server community helping its members Connect, Share, and Learn by: 
Facilitating member networking and exchange of information through our websites, Chapters, annual Summits, regional and local events, and virtual communities
Working with Microsoft to influence the evolution of SQL Server products and services
Delivering high quality, up-to-date, technical content, presentations, and other educational material for professional development

3. Abstract
Working with Azure SQL Database presents new challenges as well as opportunities compared to traditional Microsoft SQL Server. This presentation will touch on provisioning Azure SQL Servers and their associated Azure SQL DB's, SQL and Windows authentication, Performance, Security, Backup and Recovery, DR and Business Continuity, PowerShell as an Azure management tool, and migration of on-prem databases to the cloud.
START SSMS in PRESENTER MODE - In the Quick Launch toolbar, type “fonts”: - PresentOn.
This presentation will cover what I have learned from working with and reading about Azure SQLDB. I’m by no means an expert. I will go beyond the marketing info hoping to point out, distill and emphasize real-world issues most organizations will have to deal with when considering or beginning to work with Azure SQLDB.

4. What?
“A managed cloud database for developers… With built-in intelligence that learns app patterns and adapts to maximize performance, reliability, and data protection, Azure SQL Database is a cloud database built for developers.”
“Relational Database as a Service”
“Abstracts away all management of underlying infrastructure”
All these quotes are from Microsoft’s Azure website. The wording is deliberate and will guide why and when Azure SQLDB should be considered. Before we get to that….

5. On-Prem vs Cloud Service Tiers
On Premises – Traditional approach where you manage and are responsible for all layers of an application infrastructure
IaaS - Abstraction of infrastructure hardware. You still manage OS, middleware, and Runtime
PaaS – You’re responsible for managing Apps and Data (WebApps, Data services like SQL, Proxy Services, ADFS, RDS) but everything else abstracted
SaaS – Application is the only thing you need to/can manage. UNDERLYING DATA is managed by service provider

6. Title
What is gained in Agility by handing off management of supporting infrastructure …. is lost to Flexibility in creating a solution. You need to weigh what your organization is willing to pay for that flexibility and really explore if a solution can’t be developed in the cloud.

7. Why SQLDB? Low Management Overhead Easily Scale Performance/Cost
Backups built in (but…)
HA built-in (but not default!)
Fast Deployment
Latest Features
Features not tied to a License Type!
Low Maintenance Overhead
Use the Tools you know (but may need to update)
Latest SSMS 17.4 or greater – Download Here
Latest Azure Powershell Module – Download Here
Latest Visual Studio Azure – Download Here
No physical infrastructure to manage.
Move your instance between tiers of performance and capacity manually using a slider or via Azure Automation and PS
Backups can be restored but must be to new database, are not portable, no .bak files
HA is available but needs to be configured
Installing and Configuring SQL server is time intensive (often requiring reviewing infrastructure, security, licensing, etc.)
Some planning is still involved but spinning up an Azure SQLDB server and database takes minutes.
Microsoft rolls out new features first to Azure SQLDB. Features are available on your instance immediately without going through an install/upgrade.
Compare to On-Prem it’s a major project with downtime, capacity requirements, testing, application updates, etc.
Certain features only available in Enterprise Edition are available in lowest price tier of SQLDB (for example TDE, In-Memory OLTP)
Can enable auto-tuning of Server or Database, Indexes are managed for you “As your app runs, SQL Database continuously learns your unique app patterns, adaptively tunes performance, and automatically improves reliability and data protection—freeing you to focus on your app.”
SSMS, Visual Studio, SQCMD all can be used to configure and manage SQLDB.

8. When? New Application Development
Applications you control the code for
Applications that require a SQL database and are Azure SQLDB compatible (Windows Services such as Remote Desktop Services, SCCM, SCOM….)
Not recommended for migrating database backends for Vendor applications
On the about MS Azure SQLDB landing page
TSQL in Azure SQLDB is not 100% compatible with SQL Server. However most processes that use incompatible TSQL can be refactored to work in Azure SQLDB.
I’ll discuss some of this problem TSQL in a later slide.

9. What’s Missing/Not Supported ?
MSDB
TSQL
Cross Database Queries
OPEN QUERY, OPEN ROWSET, OPENDATASOURCE
CLR integration
Change Data Capture
Global Temp Tables
Mirroring, Log Shipping, AV groups
Traditional Backups
Windows Authentication
Azure SQL Database is designed to isolate features from dependencies on the master database and the operating system. As such, most server-level activities are inappropriate for SQL Database.
not available if they configure server-level options, operating system components, or specify file system configuration. When such capabilities are required, an appropriate alternative is often available in some other way from SQL Database or from another Azure feature or service.
But can Use Azure Active Directory Authentication

10. What’s Missing/Not Supported ?
Server Objects
Triggers (server scoped)
EndPoints
Linked Servers!
Management
Database Mail!
SQL Agent
SQL Server Integration Services
SQL Server Reporting Services
SQL Analysis Services
Full list here
Azure SQL Database is designed to isolate features from dependencies on the master database and the operating system. As such, most server-level activities are inappropriate for SQL Database.
not available if they configure server-level options, operating system components, or specify file system configuration. When such capabilities are required, an appropriate alternative is often available in some other way from SQL Database or from another Azure feature or service.

11. Not the End of The World
Guidance on resolving TSQL differences – Link Here
DB Mail - Monitor the log and configure alerts in Azure. Use SendGrid – Link Here
Use Temporal Tables instead of CDC
Run SSIS and SSRS in a separate low cost VM
SSIS – Azure Data Factory (ADF2)
SSAS  Azure Analysis Services
Instead of Agent, use Azure Automation and Powershell to execute queries in SQLDB (start here)
For most of the On-Prem SQL features missing in SQLDB, there is an equivalent Azure based solution
Azure Automation: Your Agent in the Cloud
Vertically scale up or down a SQL Server database on a Schedule
Run TSQL on Schedule
Indexing
Auto Start or Stop a VM
Send from Azure SQL using Logic App -

12. Portal
Create , Configure and Manage Azure SQL Servers and Databases from the Azure Portal
Assign SA
Create Azure Active Directory Admin (recommend DBA Group)

13. Access control Configure in Portal
Resource Group and Subscription Level
IAM
No initial access to database
Must configure firewall rules
Enable access from Azure Services (ex. Azure web app)
Local IP / IP Range
Auditing
Use TSQL to create logins users and roles
Access Control - Owner, Contributer, Reader, SQL DB contributor, SQL Security Manager, SQL Server Contributer, User Access Administrator
Can assign Azure AD groups to these roles
Auditing
15$/Mo
Threat Detection
Alerts

14. IAM

15. Connectivity and Authentication
SQL Server Auth
Connect to SQLDB using url
servername.database.windows.net
Connection Strings in Portal
Azure Active Directory
Universal with MFA Support
Active Directory Password -
Active Directory Integrated - logged into domain
Active Directory Admin (or Super SA)
Configure and manage Azure Active Directory authentication with SQL Database or SQL Data Warehouse (link)

16. Logins and Users CREATE LOGIN (IMPORTANT) CREATE USER (SQL)
Can only create SQL Logins (Azure AD support?)
CREATE USER (SQL)
While can create a SQL User without a Login. IMX – many functions/operations won’t work
CREATE USER (Azure AD)
Azure AD users or Groups as Database Users
No GUI to Create Logins or User - Scripts
No GUI to assign permissions or roles - Scripts
Azure and SQL server in general is moving to the portability of “Contained” databases. Databases independent of Servers
Logins are still important until this model is stable.
Require Azure Active Directory Authentication to be configured

17. Logins and Users NO GUI to tell you what access Logins have
SA vs Azure Active Directory Admin
Both See Master
Only one sees Security!?!?
No GUI to tell you what user has access to
Scripts

18. Backup Restore database from Portal Long-term backup (Preview)
Point-in-time : )
Restores as a New database : (
7 days max for point-in-time for Basic tier
35 days max for point-in-time (Standard or Premium)
Portability - Bacpac instead of .bak
Long-term backup (Preview)
Meet compliance requirements
configured at SQLDB server level
store weekly backups in Azure recovery services vault up to 10 years.
Requires configuring a Recovery Services Vault
Restore Deleted DBs (but not DB Servers)
Restores take a long time RPO great, RTO (In most cases, the recovery time is less than 12 hours!") SLA for RTO is 24 hours!
export a backup - .bacpac file, backup slow (for 1 gb db) to blob url, use Storage Explorer. Restore to New Database means you will incur the additional cost!

19. DR and BC Active Geo-replication Auto Failover Groups
Transparent geographic failover of a database
Not enabled by default!
Automatically manage replication, connectivity and failover of a DB
Auto Failover Groups
Transparent geographic failover of database groups
Automatically manage replication, connectivity and failover of a set of databases.
Read-write end point to primary DB DNS name (automatically switches w/ failover)
Read-only endpoints points to secondary DB(s)
Separate DNS name
Load balance read-only workloads
AGR - Up to 4 readable secondary's in same or different data centers. Failover must be initiated manually by the application of the user. New primary has new URL
AFG - After the database failover is completed, the DNS record is automatically updated to redirect the end-points to the new region.
* SQL Database  Geo-Replication  Add to Failover Group  Secondary Server  Enter FailoverGroupName  Set Read/Write failover policy Automatic or Manual  Set GracePeriod
* Data Sync – Synch on prem DB’s to Azure

20. Security Always Encrypted Dynamic Data Masking Row Level Security
SQL Server Audit Compliance Reporting
TDE
All Data Security options that are available in SQL Server Enterprise edition are available to you in Azure SQLDB!
Dynamic Data Masking – masks sensitive data from non-privileged users
TDE – Encrypts your data at rest so a backup or .mdf is unreadable until decrypted
Always Encrypted – which also encryptes your data during movement between client and server
Row-Level Security – allows you to control access to rows within a table based on users group membership or execution context
SQL Server Audit – tracks and logs server and database level events

21. Performance Monitoring
In Portal
Resource Health
Performance Overview (see portal)
Performance recommendations
Query Store, Reports
Query Performance Insight
Automatic Tuning
SP_Blitz
Utility DB, Add Adam Machanic SP_WhoIs Active and Brent Ozar SP’s
Monitor following
IO_QUEUE_LIMIT – in Azure SQL DB, this means your database is getting throttled.
LOG_RATE_GOVERNOR – in Azure SQL DB, this means your database is getting throttled.
RESMGR_THROTTLED – in Azure SQL DB, this means a new request has come in, but it’s throttled based on the GROUP_MAX_REQUESTS setting.
SE_REPL* – in Azure SQL DB, we’re waiting for the secondary replicas to catch up.
SSMS 17.4 Performance Reports
3rd party tools

22. Performance Monitoring

23. Performance Monitoring - Azure SQLDB Waits

24. SP_WhoIsActive

25. Database Maintenance
How to maintain Azure SQL Indexes and Statistics /how-to-maintain-azure-sql-indexes-and-statistics/
Azure Automation Methods - methods
How to perform index maintenance on Azure SQL Database -

26. Database Automatic Tuning
Configured at Server level, then inherited by databases
Can break this inheritance.

27. Database Automatic Tuning
Not turned on by default
Must specify Desired State
Settings apply to all Server databases configured for inheritance

28. Automatic index management in Azure SQL database - https://blogs. msdn
Automatic index management in Azure SQL database - management-in-azure-sql-db/
Reorganize and Rebuild Indexes - databases/indexes/reorganize-and-rebuild-indexes
How to maintain Azure SQL Indexes and Statistic - indexes-and-statistics/

29. Performance Overview - Tuning Activity

30. Performance Overview - Tuning Activity
Customize Further

31. Performance Monitoring w/ Azure SQL Analytics
Azure SQL Database can push event logs to Azure Storage, Event hub and Log Analytics.
Monitoring has no impact on Databases
Reads Logs using Log Analytics service
Intelligent Insights, will correlate performance metrics and help you isolate the issue
Log Analytics  Create Workspace  OMS Workspace  Overview  Add Azure SQL Analytics
Azure DB  Diagnostic Settings  Turn on  Send to Log Analytics
Azure SQL Analytics -
Monitor Azure SQL Database using Azure SQL Analytics (Preview) in Log Analytics - analytics-azure-sql
Can also stream logs to 3rd party performance monitoring tools
Solves the Black-Box issue with Azure SQL DB
Errors, Timeouts, Waits, Blocks, Query Durations, Executions
Create custom monitoring rules and alerts
Monitor and visualize SQL DB metrics across multiple Azure subscriptions
Identify issues at each layer of your application stack.
Create a Log Analytics workspace and then Add the Azure SQL Analytics solution to your workspace from Azure marketplace

32. Alerts
Use Azure portal to create alerts for Azure SQL Database and Data Warehouse -

33. Migration Microsoft® Data Migration Assistant v3.1 (link)
Detects compatability issue migrating on-prem SQL database
Offers solutions/work arounds

34. Costs Max Storage of DB tied to Performance Tier (link)
DTU
blended measure of CPU, memory, I/O (data and transaction log I/O)
Hourly
Performance Tiers - Increase Performance without increasing service tier
Basic - 5DTU's ($5/mo) DEV/TEST
Standard
S0, S1 ($30/Mo?)
Premium
P1 to P15 $16K/Mo
PRs (NEW)
quarter cost of equivalent Premium
Limited availability/persistence guarantee
Max Storage of DB tied to Performance Tier (link)
Azure SQL Database DTU Calculator (link)
Determines the number of DTUs for your existing SQL Server database(s)
Recommends of the minimum performance level and service tier that you need before you migrate

35. Powershell How to install and Configure Azure Powershell (link)
AzureRM – (link)
Add-AzureRMAccount / Login-AzureRmAccount
Select-AzureRMSubscription -SubscriptionName "Microsoft Azure Enterprise MSDN Dev/Test“
Install-Module AzureRM
New-AzureRMResourceGroup
New-AzureRmSQLServer
Usernames are immutable, cannot delete (can disable?)
New-AzureRmSQLServerFirewallRule ….. -AllowAllAzureIPs
Set-AzureRmSQLServerActiveDirectoryAdministrator
New-AzureRMSQLDatabase
Powershell ISE for help context

36. SSMS Performance Reports

37. In-Memory Table Optimization recommendation
In memory only available at Premium performance tiers

39. Copying, Moving, Backing Up
Depoly Database to Microsoft Azure SQl Database…
Rt. Click DB Tasks
Copies the Database

40. Moving, Backing Up Back up to Blob, need to create a storage account
Backups longer than on prem

41. Performance
SELECT query_stats.query_hash AS "Query Hash", SUM(query_stats.total_worker_time) / SUM(query_stats.execution_count) AS "Avg CPU Time", MIN(query_stats.statement_text) AS "Statement Text" FROM (SELECT QS.*, SUBSTRING(ST.text, (QS.statement_start_offset/2) + 1, ((CASE statement_end_offset WHEN -1 THEN DATALENGTH(ST.text) ELSE QS.statement_end_offset END - QS.statement_start_offset)/2) + 1) AS statement_text FROM sys.dm_exec_query_stats AS QS CROSS APPLY sys.dm_exec_sql_text(QS.sql_handle) as ST) as query_stats GROUP BY query_stats.query_hash ORDER BY 2 DESC;

42. Service End Points

43. Examples of some connection errors for Azure Active Directory Authentication with Azure SQL DB V ples-of-some-connection-errors-for-azure-active-directory- authentication/

44. Whats Next? Follow on Twitter @Azure @AzureSQLDB @AzureSQLDW
Follow Blog -

45. Links
What is the Azure SQL Database service? - technical-overview
The pros of Windows Azure SQL Database - Azure-SQL-Database
Questions About Azure SQL Database You Were Too Shy to Ask - talk/sql/database-administration/questions-azure-sql-database-shy-ask/
Resolving Transact-SQL differences during migration to SQL Database - us/azure/sql-database/sql-database-transact-sql-information
Azure SQL DB - What Happened to SQL Server Agent? - happened-to-sql-server-agent
Azure Automation: Your SQL Agent in the Cloud - sql-agent-in-the-cloud/
Explaining Database Transaction Units (DTUs) and elastic Database Transaction Units (eDTUs) -
Monitoring database performance in Azure SQL Database - database/sql-database-single-database-monitor
Why you should think twice about Windows Azure SQL Database -
Getting Started with Azure SQL Data Sync (Preview) - database-get-started-sql-data-sync
Send from Azure SQL using Logic App - SQL-using-Logic-App

46. More Links
Supported Features -
Securing your SQL Database -
Monitoring Azure SQL Database using dynamic management views - database/sql-database-monitoring-with-dmvs
Monitoring database performance in Azure SQL Database - database-single-database-monitor
Controlling and granting database access - logins
Demo SQL User with FW rule at server level and with FW rule only at DB level
Managed Instances –
“We’ve built a fully managed Azure SQL Database service, now with 100 percent SQL Server compatibility for no code changes via managed instance, and are introducing a new Azure Database Migration Service that enables a near-zero downtime migration”
Migrate SQL Server data by using Azure SQL Database Managed Instance | T
"Azure Database Migration service“ -
Use Azure portal to create alerts for Azure SQL Database and Data Warehouse - database/sql-database-insights-alerts-portal
No Profiler in Azure SQLDB, Use these Performance Monitoring DMV’s dmvs-for-sql-azure-to-analyze.htmlv
MS Data Amp 2017 | Keynotes -
Export an Azure SQL database to a BACPAC file -
Use Azure portal to create alerts for Azure SQL Database and Data Warehouse - database/sql-database-insights-alerts-portal
No profiler? Take a bacpac copy and deploy to SQL instance. Run statements against copy will monitoring with profiler, Note logins and contained user can be issue in instance environment
Azure SQLDB Extended Events -

47. More Links DR
Overview: Failover groups and active geo-replication - replication-overview
Designing highly available services using Azure SQL Database - designing-cloud-solutions-for-disaster-recovery
Azure SQL Database now supports transparent geographic failover of database groups - database-now-supports-transparent-geographic-failover-of-multiple- databases-featuring-automatic-activation/
$5 a month

48. Thank You from PASS www.sqlpass.org