Microsoft SQL Server

Connect Datost to SQL Server or Azure SQL so your team can query it from Slack.

Datost connects to Microsoft SQL Server (2016+) and Azure SQL using the official mssql driver. Once connected, Datost can list schemas, inspect tables, and run read-only queries on your behalf when teammates ask questions in Slack.

What you'll need

A SQL Server host reachable by Datost (public) or a Tunnel Agent host (private)
TCP port (default 1433)
Database name (defaults to master)
A SQL Authentication user and password

1. Create a read-only user

Run these statements as an admin against the database you want Datost to read. Replace the password before running.

-- Server-level login
CREATE LOGIN datost_readonly WITH PASSWORD = 'REPLACE_ME_STRONG_PASSWORD';

-- Database-level user
USE your_database;
CREATE USER datost_readonly FOR LOGIN datost_readonly;

-- Read-only access
ALTER ROLE db_datareader ADD MEMBER datost_readonly;

-- Required for INFORMATION_SCHEMA introspection
GRANT VIEW DEFINITION TO datost_readonly;

-- Run against the master database
CREATE LOGIN datost_readonly WITH PASSWORD = 'REPLACE_ME_STRONG_PASSWORD';

-- Then switch to your user database
CREATE USER datost_readonly FOR LOGIN datost_readonly;
ALTER ROLE db_datareader ADD MEMBER datost_readonly;
GRANT VIEW DEFINITION TO datost_readonly;

2. Connect from the admin panel

Open Data sources

In the Datost admin, go to Data sources and click Add data source.

Pick SQL Server

Choose SQL Server from the warehouse list. The form will prefill port 1433.

Enter connection details

Provide the host, port, database, username, and password for datost_readonly. Give the connection a name your team will recognize in Slack.

Test the connection

Datost runs SELECT @@VERSION against your server using an ephemeral pool and reports the server version on success. Fix any reported error before saving.

Save

On save, Datost introspects INFORMATION_SCHEMA.TABLES and INFORMATION_SCHEMA.COLUMNS to build its schema index. This usually takes a few seconds.

Public vs. private instances

If your SQL Server is publicly reachable, allowlist Datost's egress IPs on your firewall and connect directly. TLS is on by default; set SSL mode to verify-full if you want full certificate validation.

For servers inside a VPC or on-prem, install the Datost Tunnel Agent on a host that can reach your database. The agent opens an outbound connection to Datost — no inbound firewall rules, no public exposure. After the agent is online, enter the private host/port in the connection form and select your tunnel.

Azure SQL

Azure SQL Database and Azure SQL Managed Instance both work with this integration. A few specifics:

Host looks like your-server.database.windows.net
Port is always 1433
Username must include the server for contained users: datost_readonly@your-server
Add Datost's egress IPs to your Azure SQL firewall under Networking → Public access

Troubleshooting

Login failed — user exists at server level but not in the target database, or the db_datareader role was not granted.
TLS / certificate errors — lower SSL mode to require, or install a trusted cert on the server for verify-full.
Timeouts from a private host — confirm the Tunnel Agent is online and the host is resolvable from the agent's network.