Direct Database Access

What it is and what it's for

Normally, the only way to get data out of AdmCloud is through its own screens and reports. Direct Database Access opens an additional door: it lets you connect to your company's real database, with a user that can only read data, never change it, so you can:

• Build custom reports with Business Intelligence tools (Power BI, Tableau, etc.).
• Run your own SQL queries for analysis or internal audits.
• Integrate AdmCloud's data with other systems in your company.

Access is controlled by two independent pieces: first you authorize which IP addresses are allowed to attempt the connection (firewall rules), and then you create the username and password that external tool will use to connect. Both pieces are required before you can connect.

How to use it

1. Authorize the IP address you'll connect from

1. When you open the screen, AdmCloud shows you your Current IP as a reference, so you know the address of the computer or network you're currently working from.
2. In the "Create Firewall Rule" section, type the IP you want to authorize (for example, your office's fixed IP) and a Rule Name that identifies it easily (for example, "Main Office" or "Accountant's Laptop").
3. If your user is a technical AdmCloud user, you'll also see a Through IP field, which lets you authorize a full range of addresses instead of a single one.
4. Click "Enable Access". The rule becomes active right away and shows up in the table of registered rules, along with its creation date.

2. Create the connection user

1. In the "Create Database User" section, type the SQL User you want to create (for example, "powerbi_reports") and a Password that meets AdmCloud's complexity rules.
2. Click "Enable Access". AdmCloud creates the user directly in your database, with read-only permission, and adds it to the "Users with Access" table.

3. Connect from your external tool

1. Open your reporting or SQL tool (Power BI, Tableau, SQL Server Management Studio, etc.) and create a new SQL Server connection.
2. Use the Server and Database values shown right there on the AdmCloud screen, in the connection-information section (they're read-only and ready to copy).
3. Use the SQL User you created (with the server suffix AdmCloud automatically appends to it) and the password you set, with SQL Server authentication.

4. Remove an access you no longer need

1. To stop allowing connections from an IP, click the delete icon on its row in the firewall rules table.
2. To fully disable a connection user, click the delete icon on its row in the users-with-access table; the SQL user is removed from the database and can no longer connect.

Key capabilities

• See your own current IP address as a quick reference when creating a rule.
• Authorize one or several specific IP addresses that are allowed to connect.
• Create several independent connection users, for example one per tool or person who needs access.
• Check, at any time, the server and database name you need to use when connecting.
• Revoke access at any time by deleting the IP rule or the user, without affecting the rest of the configuration.
• Access created this way is always read-only: no external tool connected this way can change or delete your data.

Key fields

Validations when saving

• The IP is required and must be a valid IP address format; the same applies to the "Through IP" field when it's used.
• The rule name is required and cannot be repeated: you can't create two rules with the same name.
• The user and password are required when creating a connection user.
• The username cannot contain spaces or special characters (letters, numbers and underscore only), and cannot look like an email address.
• Some usernames are reserved and AdmCloud doesn't allow them for security reasons (for example "sa", "admin", "dbo", "guest" or "sys", among others).
• The username can't be repeated: if a connection user with that name already exists, it can't be created again.
• The password must meet AdmCloud's complexity policies (a mix of uppercase, lowercase, numbers and special characters, with a minimum length).

Availability and permissions

• This feature is only available on the Enterprise plan, and only if your company has the Enterprise "Direct Database Access" module active. If your plan or your active modules don't include it, the screen tells you the option isn't available on your edition.
• To open this screen and use any of its actions, you need the "System Administration > Customization" permission on your user group.
• The "Through IP" field (to authorize a range of addresses) only appears for technical AdmCloud users.

Tips and common issues