Sources
Azure SQL
Learn which Azure SQL databases SQL Flow captures from and why Native CDC is the only capture mode.
SQL Flow captures changes from Azure SQL Database, including Hyperscale, by reading the database's own CDC change tables. This page covers what is supported and why the source has one capture mode.
Supported versions
| Service | Supported |
|---|---|
| Azure SQL Database | Yes, with Native CDC, on any service tier where Azure SQL Database offers change data capture |
| Azure SQL Database Hyperscale | Yes, with Native CDC. |
| Azure SQL Managed Instance | Yes, as a SQL Server source with Native CDC or Polling. |
| SQL database in Microsoft Fabric | No. It has no change data capture, so it is a target only. |
On a service tier without change data capture, sys.sp_cdc_enable_db fails, so the database can't be set up for this source.
Capture modes
| Mode | What it reads |
|---|---|
| Native CDC | The change tables under the cdc schema that Azure SQL's change data capture fills. |
Native CDC is the only mode because Azure SQL exposes no transaction log to read and allows no log broker on its hosts. The wizard shows Capture mode as Native CDC for an Azure SQL source, with no other choice.
Choosing a capture mode
- Is the database Azure SQL Database or Hyperscale?
- Yes: use Native CDC. There is no other choice.
- Is it Azure SQL Managed Instance?
- Yes: add it as a SQL Server source and use Native CDC or Polling. Managed Instance doesn't allow a log broker on its hosts.
- Is it SQL Server on an Azure virtual machine?
- Yes: add it as a SQL Server source. You can install a log broker on the VM and use DirectLog or Reconstruction.
| Azure SQL Native CDC | SQL Server on a VM | |
|---|---|---|
| Capture modes | Native CDC | DirectLog, Reconstruction, Polling, Native CDC |
| Log broker | Not possible | Possible on the VM |
| Lag | The CDC capture's scan interval | Milliseconds with DirectLog |
| Windows authentication | No | Yes |
Encrypted data
TDE. Supported. Native CDC reads change tables that the engine fills from the decrypted log.
Always Encrypted columns. Refused. A selected table with an Always Encrypted column is refused with
always_encrypted_column.Connections. The agent always encrypts its connection to Azure SQL and validates the server certificate. An Azure SQL connection has no encryption setting. A connection saved with the retired option
trustServerCertificateis refused until you edit and save it, which removes the option:<connection>: option 'trustServerCertificate' is retired. Azure SQL connections always validate the server certificate, so there is no encryption setting to replace it. Remove the option.
See Encrypted data support for every engine.
