Automate management with the Windows SQL Server IaaS Agent extension

Applies to: SQL Server on Azure VM

The SQL Server IaaS Agent extension (SqlIaasExtension) runs on SQL Server on Azure Windows Virtual Machines (VMs) to automate management and administration tasks.

This article provides an overview of the extension. To install the SQL Server IaaS Agent extension to SQL Server on Azure VMs, see the articles for Automatic registration, Register single VMs, or Register VMs in bulk.

To learn more about the SQL Server on Azure VM deployment and management experience, watch the following Data Exposed videos:

• Automate Management with the SQL Server IaaS Agent extension
• New and Improved SQL on Azure VM deployment and management experience.

Overview

The SQL Server IaaS Agent extension integrates with the Azure portal and unlocks several benefits for SQL Server on Azure VMs:

• Feature benefits: The extension unlocks automation feature benefits, such as portal management, license flexibility, automated backup, automated patching, and more. For details, see Feature benefits.

• Compliance: The extension offers a simplified method to fulfill the requirement of notifying Microsoft that you enabled the Azure Hybrid Benefit, as specified in the product terms. This process negates the need to manage licensing registration forms for each resource.

• Free: The extension is free. There's no additional cost associated with the extension.

• Integration with centrally managed Azure Hybrid Benefit: SQL Server VMs registered with the extension can integrate with Centrally managed Azure Hybrid Benefit, so it's easy to manage the Azure Hybrid Benefit for your SQL Server VMs at scale.

• Simplified license management: The extension simplifies SQL Server license management, and you can quickly identify SQL Server VMs with the Azure Hybrid Benefit enabled by using:

  • Azure portal
  • PowerShell
  • Azure CLI

  Use the SQL virtual machines resource in the Azure portal to quickly identify SQL Server VMs that use the Azure Hybrid Benefit.

Enable auto upgrade to ensure you get the latest updates to the extension each month.

Feature benefits

The SQL Server IaaS Agent extension provides several feature benefits for managing your SQL Server VM. You can choose the benefits that best suit your business needs. When you first register with the extension, you get access to features that don't rely on the SQL IaaS Agent. When you enable a feature that requires the agent, the agent is installed on the SQL Server VM.

The following table lists the benefits you can get through the SQL IaaS Agent extension and whether the agent is required for each benefit:

Permission models

By default, the SQL IaaS Agent extension uses the least privilege mode permission model. The least privilege permission model grants the minimum permissions required for each feature that you enable. Each feature that you use is assigned a custom role in SQL Server, and the custom role only has permissions that are required to perform actions related to the feature.

The following table defines the SQL Server permissions and custom roles used by each feature of the extension:

SQL Server VMs deployed before October 2022 use the older sysadmin model where the SQL IaaS Agent extension takes sysadmin rights by default. For SQL Server VMs provisioned before October 2022, you can enable the least privilege permissions model manually.

To enable the least privilege permissions model, go to your SQL virtual machines resource, choose Security Configuration under Security, and then select the Enable least privilege mode checkbox:

Installation

When you register your SQL Server VM with the SQL IaaS Agent extension, the process copies binaries to the virtual machine but doesn't install the agent by default. The agent installs only when you enable one of the SQL IaaS Agent extension features that require it. After installation, the following two services run on the virtual machine:

• Microsoft SQL Server IaaS agent is the main service for the SQL IaaS Agent extension. It runs under the Local System account.
• Microsoft SQL Server IaaS Query Service is a helper service that runs queries within SQL Server. It runs under the NT Service account NT Service\SqlIaaSExtensionQuery.

By default, the agent follows the principle of least privilege and only has permissions within SQL Server that are associated with the features you enable. However, if you manually install SQL Server on the VM yourself, or deploy a SQL Server image from the marketplace before October 2022, the agent has sysadmin rights within SQL Server.

When you deploy a SQL Server VM Azure Marketplace image through the Azure portal, it's automatically registered with the extension. However, if you choose to self-install SQL Server on an Azure virtual machine, or provision an Azure virtual machine from a custom VHD, you must register your SQL Server VM with the SQL IaaS Agent extension to unlock feature benefits. By default, self-installed Azure VMs with SQL Server 2016 or later automatically register with the SQL IaaS Agent extension when detected by the CEIP service. You should manually register SQL Server VMs that the CEIP doesn't detect.

You can register by using one of the following methods:

• Automatically for all current and future VMs in a subscription
• Manually for a single VM
• Manually for multiple VMs in bulk

When you register your SQL Server VM with the SQL Server IaaS Agent extension, you create the SQL virtual machine resource within your subscription. This resource is separate from the virtual machine resource. If you delete the extension from your SQL Server VM, you remove the SQL virtual machine resource from your subscription but don't delete the underlying virtual machine.

Multiple instance support

The SQL IaaS Agent extension supports the following environments:

• One default instance.
• Multiple instances, but only the default instance is supported and managed by the extension in the Azure portal. The extension doesn't support environments with multiple named instances without a default instance.
• One named instance, if it's the only installed instance.

Named instance support

To manage a single named instance in the Azure portal, install SQL Server with a non-default name on an Azure virtual machine and then register it with the SQL IaaS Agent extension.

To manage a single named instance in a SQL Server image from Azure Marketplace, uninstall the existing SQL Server instance, install SQL Server with a named instance, and then register it with the SQL IaaS Agent extension.

To use a single named instance with SQL Server on Azure VMs, follow these steps:

1. Deploy a SQL Server VM from Azure Marketplace.
2. Delete the SQL IaaS Agent extension from the SQL Server VM.
3. Connect to the virtual machine and uninstall SQL Server completely.
4. Restart the virtual machine.
5. Connect to the virtual machine and then use the setup media (typically located in C:\SQLServerFull) to install a named SQL Server instance.
6. Restart the virtual machine.
7. Register the VM with the SQL IaaS Agent Extension.

Failover Clustered Instance support

Registering your SQL Server Failover Clustered Instance (FCI) is supported with limited functionality. Due to the limited functionality, SQL Server FCIs registered with the extension don't support features that require the agent, such as automated backup, patching, Microsoft Entra authentication, and advanced portal management.

If you register your SQL Server VM with the SQL IaaS Agent extension and enable any features that require the agent, you need to delete the extension from the SQL Server VM. Then register it again after your FCI is installed.

Verify status of extension

Use the Azure portal, Azure PowerShell, or the Azure CLI to check the status of the extension.

Get-AzVMSqlServerExtension -VMName "vmname" -ResourceGroupName "resourcegroupname"

 $sqlext = Get-AzVMSqlServerExtension -VMName "vmname" -ResourceGroupName "resourcegroupname"
 $sqlext.AutoPatchingSettings
 $sqlext.AutoBackupSettings

Management modes

Before March 2023, the SQL IaaS Agent extension relied on management modes to define the security model, and unlock feature benefits. In March 2023, Microsoft updated the extension architecture to remove management modes entirely. Instead, it relies on the principle of least privilege to give you control over how you want to use the extension on a feature-by-feature basis.

Starting in March 2023, when you first register with the extension, it saves binaries to your virtual machine to provide basic functionality such as license management. When you enable any feature that relies on the agent, the extension uses the binaries to install the SQL IaaS Agent to your virtual machine. It also assigns permissions to the SQL IaaS Agent service as needed by each feature that you enable.

Supported regions

The SQL IaaS Agent extension is supported in a limited set of Azure regions. You can only install the SQL IaaS Agent extension if your SQL Server VM is in a supported region. You can use Azure PowerShell to list the supported regions for the SQL IaaS Agent extension.

The following Get-AzResourceProvider Azure PowerShell command lists the supported regions:

(Get-AzResourceProvider -ProviderNamespace Microsoft.SqlVirtualMachine).ResourceTypes |
      Where-Object { $_.ResourceTypeName -eq "SqlVirtualMachines" } |
      Select-Object -ExpandProperty Locations

Limitations

The SQL IaaS Agent extension only supports:

• SQL Server VMs deployed through the Azure Resource Manager. It doesn't support SQL Server VMs deployed through the classic model.
• SQL Server VMs deployed to the public cloud, Azure Government cloud, and 21Vianet (Azure in China). It doesn't support deployments to other private or government clouds.
• A limited set of Azure regions. You can only install the SQL IaaS Agent extension if your SQL Server VM is in a supported region.
• TCP/IP must be enabled in SQL Server Configuration Manager and for the VM for the extension to work with your SQL Server on Azure VMs.
• SQL Server FCIs with limited functionality. SQL Server FCIs registered with the extension don't support features that require the agent, such as automated backup, patching, and advanced portal management.
• VMs with a default instance, or a single named instance when no default instance is present.
• If the VM has multiple named instances, then one of the instances must be the default instance to work with the SQL IaaS Agent extension.
• SQL Server instance images only. The SQL IaaS Agent extension doesn't support Reporting Services or Analysis services, such as the following images: SQL Server Reporting Services, Power BI Report Server, SQL Server Analysis Services.

Privacy statements

When you use SQL Server on Azure VMs and the SQL IaaS Agent extension, consider the following privacy statements:

• Automatic registration: By default, Azure VMs with SQL Server 2016 or later are automatically registered with the SQL IaaS Agent extension when detected by the CEIP service. Review the SQL Server privacy supplement for more information.

• Data collection: The SQL IaaS Agent extension collects data for the express purpose of giving customers optional benefits when using SQL Server on Azure Virtual Machines. Microsoft will not use this data for licensing audits without the customer's advance consent. See the SQL Server privacy supplement for more information.

• In-region data residency: SQL Server on Azure VMs and the SQL IaaS Agent extension don't move or store customer data outside of the region where you deployed the VMs.

Related content

To install the SQL Server IaaS extension to SQL Server on Azure VMs, see the articles for Automatic installation, Single VMs, or VMs in bulk. For problem resolution, see Troubleshoot known issues with the extension.

To learn more, see the following articles:

• Updating SQL Server on Azure VMs
• Overview of SQL Server on Windows VMs
• FAQ for SQL Server on Windows VMs
• Pricing guidance for SQL Server on Azure VMs
• What's new for SQL Server on Azure VMs