SQL Server

Common questions about SQL Server on Tessell, covering SSRS and master user permissions.

---

Q: Does Tessell support SQL Server Reporting Services (SSRS)?

A: Yes. Tessell supports SQL Server Reporting Services (SSRS), Microsoft's server-based reporting platform for creating, managing, and delivering interactive and paginated reports.

Prerequisites:

• SSRS must be installed using the Tessell option profile for SQL Server.
• The SQL Server instance must be integrated with a Microsoft Active Directory domain for SSRS to authenticate users.
• The xp_cmdshell parameter must be set to 1 in the parameter group before installation. It is recommended to turn it off again once the SSRS package has been imported.

Granting permissions:

Before deploying reports, grant the required permissions to the DB user account using the Tessell-provided stored procedure:

use master
go
EXEC msdb.dbo.t_sp_grant_ssrs_permissions 'tesl\admin','System Administrator'
go

The stored procedure supports System Administrator and System User roles.

Connectivity:

The SSRS web portal is accessible at:

https://<TESSELL_ENDPOINT>:<port>/Reports

Replace <TESSELL_ENDPOINT> with your Tessell DB service endpoint and <port> with the SSRS port number.

Configuring SSRS after installation:

1. Open the SSRS web portal and navigate to Site Settings.
2. Configure general settings (report server name, encryption, email delivery).
3. Adjust security settings to restrict access to authorized users.
4. Configure data source connections to databases required for report generation.
5. Set up scheduling and subscriptions for automated delivery.

---

Q: What security permissions does the master user have in Tessell for SQL Server?

A: Tessell provisions one master login per SQL Server database service. This master user is granted a specific set of server-level permissions that allow full operational control without exposing platform-level administrative roles that could compromise the managed environment.

Permissions granted to the master user:

Permission	Description
ADMINISTER BULK OPERATIONS	Execute bulk import/export operations for data movement
ALTER ANY CREDENTIAL	Modify credentials used for authenticating external resources
ALTER ANY EVENT SESSION	Modify event sessions for analysis and troubleshooting
ALTER ANY LINKED SERVER	Modify linked server configurations for cross-instance communication
ALTER ANY LOGIN	Create and modify login credentials for database access
ALTER ANY SERVER AUDIT	Modify server audit configurations for activity tracking
ALTER ANY SERVER ROLE	Modify server roles and their permissions
ALTER TRACE	Enable and manage trace configurations for query monitoring
CONNECT SQL	Establish connections to the SQL Server instance
CREATE ANY DATABASE	Create new databases within the SQL Server instance
VIEW ANY DATABASE	View metadata about all databases in the instance
VIEW ANY DEFINITION	Access definitions of database objects
VIEW SERVER STATE	View the SQL Server instance's current state and performance metrics
ALTER ROLE	Modify roles within the database
SQLAgentOperatorRole	Manage SQL Server Agent jobs and schedules (in msdb context)
db_datareader	Read access on the master database
GRANT SHOWPLAN	View Showplan query output — use with caution as it may expose passwords

Roles explicitly NOT granted (elevated platform-level roles withheld for security):

Role	Reason withheld
bulkadmin	Allows BULK INSERT statements that could impact data integrity
dbcreator	Create/alter/drop databases — controlled via server-level trigger
diskadmin	Manage disk files and storage configurations
securityadmin	Manage logins and server-level permissions
serveradmin	Configure server-wide settings affecting all databases
sysadmin	Unrestricted administrative access to the entire SQL Server instance

Requesting additional permissions:

If your workload requires permissions beyond the defaults, contact Tessell Support. Tessell will perform a risk assessment, evaluate feasibility, and provision approved permissions in a controlled manner.