Least privilege monitoring of SQL for AppInsight and DPA

robert777

Good Day.

We have a SQL cluster monitored with both AppInsight SQL, and DPA.  This is an Always-On failover cluster with 2 servers in main site set up for synchronous replication and 1 server in alt site with asynchronous replication.

It has been noted that the accounts used for monitoring have SA-equivalent level of privilege.  I've been tasked with working out how to monitor the cluster with AI and DPA using less-than-SA privileges.

Reviewing the following SolarWinds technical docs for setting up AI and DPA monitoring with least-privilege:

for AI:

https://documentation.solarwinds.com/en/success_center/sam/content/sam-appinsight-for-sql-requirements-and-permissions-sw1273.htm 

for DPA:

https://solarwindscore.my.site.com/SuccessCenter/s/article/Register-a-SQL-Server-instance-without-the-sysadmin-role?language=en_US

Wondering... can we use the same account for AI and DPA monitoring?  Or do we need 2 separate accounts? The permissions detailed in the two articles do not appear to contradict.

I welcome any inputs from the community for the best way to set up AI SQL and DPA monitoring for SQL cluster using least-privilege permissions.

Thanks.

Lofstrand

Hi, You can use the same account. Combining what the two products require. 

One advantage of using separate account can be that it's easier to see what each application is doing. But using one account is less accounts to administer. So it's up to you.