azure-resource-manager-sql-dotnet – DevOps & Infrastructure skill for AI agents

Bundled upstream support

Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.

Azure.ResourceManager.Sql (.NET)

Management plane SDK for provisioning and managing Azure SQL resources via Azure Resource Manager.

> ⚠️ Management vs Data Plane

> - This SDK (Azure.ResourceManager.Sql): Create servers, databases, elastic pools, configure firewall rules, manage failover groups

> - Data Plane SDK (Microsoft.Data.SqlClient): Execute queries, stored procedures, manage connections

Installation

dotnet add package Azure.ResourceManager.Sql
dotnet add package Azure.Identity

Version boundary: These are illustrative fragments, not a compiled project. Pin the intended SDK version and check its API reference and regional SKU availability before adapting; no current-version claim is established here.

Environment Variables

AZURE_SUBSCRIPTION_ID=<your-subscription-id>
# For service principal auth (optional)
AZURE_TENANT_ID=<tenant-id>
AZURE_CLIENT_ID=<client-id>
AZURE_CLIENT_SECRET=<client-secret>

Authentication

using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Sql;

// Always use DefaultAzureCredential
var credential = new DefaultAzureCredential();
var armClient = new ArmClient(credential);

// Get subscription
var subscriptionId = Environment.GetEnvironmentVariable("AZURE_SUBSCRIPTION_ID");
var subscription = armClient.GetSubscriptionResource(
    new ResourceIdentifier($"/subscriptions/{subscriptionId}"));

Resource Hierarchy

ArmClient
└── SubscriptionResource
    └── ResourceGroupResource
        └── SqlServerResource
            ├── SqlDatabaseResource
            ├── ElasticPoolResource
            │   └── ElasticPoolDatabaseResource
            ├── SqlFirewallRuleResource
            ├── FailoverGroupResource
            ├── ServerBlobAuditingPolicyResource
            ├── EncryptionProtectorResource
            └── VirtualNetworkRuleResource

Core Workflow

Confirm subscription, tenant, resource group, exact target, SKU budget and production-change scope before any write. Read current state and use update/patch semantics appropriate to the pinned SDK; a sparse CreateOrUpdate payload is not proof that omitted settings are preserved. Management authentication does not grant SQL data-plane access. Do not log passwords, connection strings or storage keys. Private networking requires endpoint, DNS and routing setup; disabling public access alone does not establish connectivity.

1. Create SQL Server

using System;
using Azure.ResourceManager.Sql;
using Azure.ResourceManager.Sql.Models;

// Get resource group
var resourceGroup = await subscription
    .GetResourceGroupAsync("my-resource-group");

// Define server
var serverData = new SqlServerData(AzureLocation.EastUS)
{
    AdministratorLogin = "sqladmin",
    AdministratorLoginPassword = Environment.GetEnvironmentVariable("SQL_ADMIN_PASSWORD") ?? throw new InvalidOperationException("SQL_ADMIN_PASSWORD is required"),
    Version = "12.0",
    MinimalTlsVersion = SqlMinimalTlsVersion.Tls1_2,
    PublicNetworkAccess = ServerNetworkAccessFlag.Disabled // configure approved private endpoint and DNS separately
};

// Create server (long-running operation)
var serverCollection = resourceGroup.Value.GetSqlServers();
var operation = await serverCollection.CreateOrUpdateAsync(
    WaitUntil.Completed,
    "my-sql-server",
    serverData);

SqlServerResource server = operation.Value;

2. Create SQL Database

var databaseData = new SqlDatabaseData(AzureLocation.EastUS)
{
    Sku = new SqlSku("S0") { Tier = "Standard" },
    MaxSizeBytes = 2L * 1024 * 1024 * 1024, // 2 GB
    Collation = "SQL_Latin1_General_CP1_CI_AS",
    RequestedBackupStorageRedundancy = SqlBackupStorageRedundancy.Local
};

var databaseCollection = server.GetSqlDatabases();
var dbOperation = await databaseCollection.CreateOrUpdateAsync(
    WaitUntil.Completed,
    "my-database",
    databaseData);

SqlDatabaseResource database = dbOperation.Value;

3. Create Elastic Pool

var poolData = new ElasticPoolData(AzureLocation.EastUS)
{
    Sku = new SqlSku("StandardPool")
    {
        Tier = "Standard",
        Capacity = 100 // 100 eDTUs
    },
    PerDatabaseSettings = new ElasticPoolPerDatabaseSettings
    {
        MinCapacity = 0,
        MaxCapacity = 100
    }
};

var poolCollection = server.GetElasticPools();
var poolOperation = await poolCollection.CreateOrUpdateAsync(
    WaitUntil.Completed,
    "my-elastic-pool",
    poolData);

ElasticPoolResource pool = poolOperation.Value;

4. Add Database to Elastic Pool

var databaseData = new SqlDatabaseData(AzureLocation.EastUS)
{
    ElasticPoolId = pool.Id
};

await databaseCollection.CreateOrUpdateAsync(
    WaitUntil.Completed,
    "pooled-database",
    databaseData);

5. Configure Firewall Rules

// OPTIONAL broad exception: 0.0.0.0 permits connections from Azure services
// outside this subscription too; it is not a tenant-only firewall rule. Do not
// apply by default. With public access disabled these rules do not enable it.
// Allow Azure services
var azureServicesRule = new SqlFirewallRuleData
{
    StartIPAddress = "0.0.0.0",
    EndIPAddress = "0.0.0.0"
};

var firewallCollection = server.GetSqlFirewallRules();
await firewallCollection.CreateOrUpdateAsync(
    WaitUntil.Completed,
    "AllowAzureServices",
    azureServicesRule);

// Allow specific IP range
var clientRule = new SqlFirewallRuleData
{
    StartIPAddress = "203.0.113.0",
    EndIPAddress = "203.0.113.255"
};

await firewallCollection.CreateOrUpdateAsync(
    WaitUntil.Completed,
    "AllowClientIPs",
    clientRule);

6. List Resources

// List all servers in subscription
await foreach (var srv in subscription.GetSqlServersAsync())
{
    Console.WriteLine($"Server: {srv.Data.Name} in {srv.Data.Location}");
}

// List databases in a server
await foreach (var db in server.GetSqlDatabases())
{
    Console.WriteLine($"Database: {db.Data.Name}, SKU: {db.Data.Sku?.Name}");
}

// List elastic pools
await foreach (var ep in server.GetElasticPools())
{
    Console.WriteLine($"Pool: {ep.Data.Name}, DTU: {ep.Data.Sku?.Capacity}");
}

7. Get Connection String

// Use returned FQDN; sovereign cloud suffixes can differ.
var serverFqdn = server.Data.FullyQualifiedDomainName;
var connectionString = $"Server=tcp:{serverFqdn},1433;" +
    $"Initial Catalog={database.Data.Name};" +
    "Persist Security Info=False;" +
    $"User ID={server.Data.AdministratorLogin};" +
    "Password=<your-password>;" +
    "MultipleActiveResultSets=False;" +
    "Encrypt=True;" +
    "TrustServerCertificate=False;" +
    "Connection Timeout=30;";

Key Types Reference

| Type | Purpose |

|------|---------|

| ArmClient | Entry point for all ARM operations |

| SqlServerResource | Represents an Azure SQL server |

| SqlServerCollection | Collection for server CRUD |

| SqlDatabaseResource | Represents a SQL database |

| SqlDatabaseCollection | Collection for database CRUD |

| ElasticPoolResource | Represents an elastic pool |

| ElasticPoolCollection | Collection for elastic pool CRUD |

| SqlFirewallRuleResource | Represents a firewall rule |

| SqlFirewallRuleCollection | Collection for firewall rule CRUD |

| SqlServerData | Server creation/update payload |

| SqlDatabaseData | Database creation/update payload |

| ElasticPoolData | Elastic pool creation/update payload |

| SqlFirewallRuleData | Firewall rule creation/update payload |

| SqlSku | SKU configuration (tier, capacity) |

Common SKUs

Database SKUs

| SKU Name | Tier | Description |

|----------|------|-------------|

| Basic | Basic | 5 DTUs, 2 GB max |

| S0-S12 | Standard | 10-3000 DTUs |

| P1-P15 | Premium | 125-4000 DTUs |

| GP_Gen5_2 | GeneralPurpose | vCore-based, 2 vCores |

| BC_Gen5_2 | BusinessCritical | vCore-based, 2 vCores |

| HS_Gen5_2 | Hyperscale | vCore-based, 2 vCores |

Elastic Pool SKUs

| SKU Name | Tier | Description |

|----------|------|-------------|

| BasicPool | Basic | 50-1600 eDTUs |

| StandardPool | Standard | 50-3000 eDTUs |

| PremiumPool | Premium | 125-4000 eDTUs |

| GP_Gen5_2 | GeneralPurpose | vCore-based |

| BC_Gen5_2 | BusinessCritical | vCore-based |

Best Practices

1. Use WaitUntil.Completed for operations that must finish before proceeding

2. Use WaitUntil.Started when you want to poll manually or run operations in parallel

3. Always use DefaultAzureCredential — never hardcode passwords in production

4. Handle RequestFailedException for ARM API errors

5. Use CreateOrUpdateAsync for idempotent operations

6. Navigate hierarchy via Get* methods (e.g., server.GetSqlDatabases())

7. Use elastic pools for

… (full content is in the download package)