See Database Users, Roles, and Passwords for a general database setup for Datical DB.

The Datical Packager process requires elevated privileges on a REF Azure SQL Database as an ephemeral database is created and dropped as part of the Backup and Restore operations. The below instructions show how to setup separate Logins and Users for a REF database versus a non-REF database.

Make sure that you are connected to the master database as the Server admin and use the master database to run commands:

CREATE LOGIN [datical_ref_login] WITH PASSWORD=N'<password>';
CREATE USER [datical_ref_user] FOR LOGIN [datical_ref_login];
EXEC sp_addrolemember 'dbmanager', 'datical_ref_user';

The dbmanager role is a Server-level role required for managing and creating databases. Additionally, if the Datical User needs the ability to create and manage logins, include the following role:

EXEC sp_addrolemember 'loginmanager', 'datical_ref_user';

The default Azure password complexity rules are the following: minimum length of 8 characters, minimum of 1 uppercase character, minimum of 1 lowercase character, minimum of 1 number.

Create a REF Database User

Create a user (datical_ref_user) for a database where Packager operation will be performed:

Role/Permission	When is this required?	Permissions

Role/Permission	When is this required?	Permissions
db_owner	This role is required for REF databases and the Packager process to create an ephemeral copy of the database during Backup and Restore.	Manage fixed-database role membership, configuration, and maintenance activities.
VIEW DATABASE STATE	This is required for some Datical operations such as using Approximate Row Counts.	Read data from dynamic management views scoped to the database.

You must be connected to the database instance you want to use with Datical DB while granting permissions.

CREATE USER [datical_ref_user] FOR LOGIN [datical_ref_login];
EXEC sp_addrolemember 'db_owner', 'datical_ref_user';

Make sure that you are connected to the master database as the Server admin and use the master database to run commands:

Create a non-REF Database User

Create a user (datical_user) for database where Forecast and Deploy (not Packager) operations will be performed:

Role/Permission	When is this required?	Permissions

Role/Permission	When is this required?	Permissions
db_ddladmin	This is required if you do not connect as the database owner.	Run any Data Definition Language (DDL) command in a database.
db_datawriter	This is required if you do not connect as the database owner.	Add, delete, or change data in all user tables.
db_datareader	This is required if you do not connect as the database owner.	Read all data from all user tables.
VIEW DATABASE STATE	This is required for some Datical operations such as using Approximate Row Counts.	Read data from dynamic management views scoped to the database.

Liquibase Enterprise Documentation Home

Roles and Permissions for Liquibase Enterprise and Azure SQL Database

Create a REF Database User

Create a non-REF Database User

Create a REF Datical Login and User

Create a REF Database User

Create a non-REF Datical Login and User

Create a non-REF Database User