> For the complete documentation index, see [llms.txt](https://docs.tessell.com/tessell/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tessell.com/tessell/faq/engines/sql-server.md).

# SQL Server

Common questions about SQL Server on Tessell, covering SSRS and master user permissions.

***

### Q: Does Tessell support SQL Server Reporting Services (SSRS)?

**A:** Yes. Tessell supports **SQL Server Reporting Services (SSRS)**, Microsoft's server-based reporting platform for creating, managing, and delivering interactive and paginated reports.

**Prerequisites:**

* SSRS must be installed using the **Tessell option profile** for SQL Server.
* The SQL Server instance must be integrated with a **Microsoft Active Directory domain** for SSRS to authenticate users.
* The `xp_cmdshell` parameter must be set to `1` in the parameter group before installation. It is recommended to turn it off again once the SSRS package has been imported.

**Granting permissions:**

Before deploying reports, grant the required permissions to the DB user account using the Tessell-provided stored procedure:

```sql
use master
go
EXEC msdb.dbo.t_sp_grant_ssrs_permissions 'tesl\admin','System Administrator'
go
```

The stored procedure supports `System Administrator` and `System User` roles.

**Connectivity:**

The SSRS web portal is accessible at:

```
https://<TESSELL_ENDPOINT>:<port>/Reports
```

Replace `<TESSELL_ENDPOINT>` with your Tessell DB service endpoint and `<port>` with the SSRS port number.

**Configuring SSRS after installation:**

1. Open the SSRS web portal and navigate to **Site Settings**.
2. Configure general settings (report server name, encryption, email delivery).
3. Adjust security settings to restrict access to authorized users.
4. Configure data source connections to databases required for report generation.
5. Set up scheduling and subscriptions for automated delivery.

***

### Q: What security permissions does the master user have in Tessell for SQL Server?

**A:** Tessell provisions one **master login** per SQL Server database service. This master user is granted a specific set of server-level permissions that allow full operational control without exposing platform-level administrative roles that could compromise the managed environment.

**Permissions granted to the master user:**

| Permission                   | Description                                                              |
| ---------------------------- | ------------------------------------------------------------------------ |
| `ADMINISTER BULK OPERATIONS` | Execute bulk import/export operations for data movement                  |
| `ALTER ANY CREDENTIAL`       | Modify credentials used for authenticating external resources            |
| `ALTER ANY EVENT SESSION`    | Modify event sessions for analysis and troubleshooting                   |
| `ALTER ANY LINKED SERVER`    | Modify linked server configurations for cross-instance communication     |
| `ALTER ANY LOGIN`            | Create and modify login credentials for database access                  |
| `ALTER ANY SERVER AUDIT`     | Modify server audit configurations for activity tracking                 |
| `ALTER ANY SERVER ROLE`      | Modify server roles and their permissions                                |
| `ALTER TRACE`                | Enable and manage trace configurations for query monitoring              |
| `CONNECT SQL`                | Establish connections to the SQL Server instance                         |
| `CREATE ANY DATABASE`        | Create new databases within the SQL Server instance                      |
| `VIEW ANY DATABASE`          | View metadata about all databases in the instance                        |
| `VIEW ANY DEFINITION`        | Access definitions of database objects                                   |
| `VIEW SERVER STATE`          | View the SQL Server instance's current state and performance metrics     |
| `ALTER ROLE`                 | Modify roles within the database                                         |
| `SQLAgentOperatorRole`       | Manage SQL Server Agent jobs and schedules (in `msdb` context)           |
| `db_datareader`              | Read access on the `master` database                                     |
| `GRANT SHOWPLAN`             | View Showplan query output — use with caution as it may expose passwords |

**Roles explicitly NOT granted** (elevated platform-level roles withheld for security):

| Role            | Reason withheld                                                      |
| --------------- | -------------------------------------------------------------------- |
| `bulkadmin`     | Allows BULK INSERT statements that could impact data integrity       |
| `dbcreator`     | Create/alter/drop databases — controlled via server-level trigger    |
| `diskadmin`     | Manage disk files and storage configurations                         |
| `securityadmin` | Manage logins and server-level permissions                           |
| `serveradmin`   | Configure server-wide settings affecting all databases               |
| `sysadmin`      | Unrestricted administrative access to the entire SQL Server instance |

**Requesting additional permissions:**

If your workload requires permissions beyond the defaults, contact **Tessell Support**. Tessell will perform a risk assessment, evaluate feasibility, and provision approved permissions in a controlled manner.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.tessell.com/tessell/faq/engines/sql-server.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.