SQL permission role requirements on the SolarWinds Platform

7/2/2019 12:59 AM

10/21/2026 8:04 AM

SQL permission or role requirements depend on the scenarios that you are involved. The article will explain the necessary permission needed for different scenarios. 

 

Example Scenarios: 

• Fresh installation of the SolarWinds Platform and at least one module 
  • NPM
  • SAM
  • NCM
  • IPAM
  • NTA, SRM, WPM, UDT, etc.

 

• Adding a module or product to an existing SolarWinds Platform 
  • If you already have NPM and are adding SAM or NCM

 

• An upgrade from one version to another version
  • If you are upgrading from 2019.4 to 2020.2, as an example
  • When upgrading to 2019.4 or 2020.2, you may be asked to install Log Analyzer, forcing you to create a new database and database user.
  • Installing version 2022.3 or later requires creating databases for Log Analyzer and Netflow Traffic Analyzer, if they don't already exist.

 

• When running the Configuration Wizard after doing minor changes

Orion Platform

 

Example Scenarios: 

• If you are creating a new database or a new Entra user:
  • As with a fresh installation or adding a product that needs to create a new database, like NTA or LA
  • The Entra identity you connect with must be the Microsoft Entra admin of the Azure SQL server (directly or via an admin group). The Configuration Wizard uses it to create the database, create the SolarWinds user with CREATE USER … FROM EXTERNAL PROVIDER, and grant it the db_owner role.
  • The user account must be a member of the dbcreator server role. 
    • Note: The sysadmin role and the SA user account are always members of dbcreator

 

• If you are using an existing database: 
  • As in upgrading an existing product, like NPM 2019.4 to 2020.2
  • The user account needs only to be in the db_owner database role for the existing database.

 

• If you are creating a new SQL account for use with Orion NPM: 
  • As with a fresh installation or installing a new product, like NTA or LA
  • The user account must be a member of the securityadmin server role.
    • Note: The sysadmin role and the SA user account are always members of securityadmin.

 

• If you are using an existing SQL account: 
  • As when running the Configuration Wizard after minor changes are made
  • The user account needs only to be in the db_owner database role for the Orion NPM database.

 

• If you are using an existing Entra identity:
  • As when re‑running the Configuration Wizard or upgrading
  • The account does not need to be pre‑created in the product database — the Configuration Wizard creates it and grants db_owner automatically. The account only needs to already exist in the master database.

 

• If you are configuring an Additional Polling Engine (APE) with a System‑Assigned Managed Identity:
  • As when the Main Poller already uses a System‑Assigned Managed Identity and you want the APE to use the same authentication
  • A System‑Assigned Managed Identity only works from the machine it belongs to, so each APE has its own identity. Before configuring the APE, add its System‑Assigned Managed Identity as a user to the master database. Then, during the scene where you connect to the server, use a privileged Entra identity (for example, the Microsoft Entra admin) so the Configuration Wizard can create the APE's System Managed Identity user in the SolarWinds database.

 

• In all scenarios, ensure that you have read permissions to the master database in SQL Server to perform the upgrade. 
• In all scenarios, the Entra account must exist as a user in the master database with read permission (db_datareader), so the Configuration Wizard can validate the server and enumerate databases.  
  • The user account needs both VIEW SERVER STATE and VIEW SERVER PERFORMANCE STATE permissions enabled.

 

Note: It is essential to understand that if you are installing a new database, you will often be prompted to create a new user account, like in the installation of NTA or LA. In this case, you will need both the db_owner, dbcreator, and the securityadmin server roles to create the product user account and the new database.