Connect Azure MySQL to DSPM

Overview

Netskope DSPM supports scanning Azure MySQL Stores. Follow these instructions to set up your Azure MySQL database and configure its connection to Netskope DSPM.

Create an Azure MySQL Netskope DSPM Service Account

Begin by configuring an Azure MySQL service account, which will be dedicated to Netskope DSPM’s use. Use a CLI such as Azure Cloud Shell or PowerShell to complete the following steps.

1. Connect to your MySQL database as an administrator.
2. Create the Netskope DSPM-specific Azure MySQL user by executing the following commands in order. 

Command	Outcome	Notes
CREATE LOGIN 'dasera_user' WITH PASSWORD ='dasera_password';	Creates the Netskope DSPM-specific DB user, which will be dedicated to Netskope DSPM’s use as a service account.	Substitute dasera_user and dasera_password with your own preferred values. You will need this information later when configuring Netskope DSPM. Note: We recommend using Netskope DSPM as the username and password of your choice. You will need this information later when configuring Netskope DSPM.
USE "database name"; CREATE USER dasera FOR LOGIN 'dasera_user'; ALTER ROLE db_datareader ADD MEMBER dasera;	Grants read-only access to the Netskope DSPM-specific DB user in each MySQL database you want to scan. The CREATE USER command enables the previously-created LOGIN to access the database. The built-in db_datareader role grants read-only access to all schemas and tables (including system tables) on the active database.	Substitute “database name” with each MySQL DB you wish to scan with the Netskope  DSPM Application.

Retrieve Connection Information

In addition to configuring a service account, Netskope DSPM requires additional information to communicate with your Azure MySQL database. Please follow the steps below to identify the connection values for later use within Netskope DSPM.

1. From your Azure MySQL console, click Settings > Connection strings from the left side nav.

Highlight Color	Corresponding Netskope DSPM Value	Example
Red	Data Store Endpoint

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the following fields:

Field	Value
Azure Account Name	Select one of the Azure Accounts defined within the Infrastructure Section screen. The field will default if there is just one Azure account configured.
Data Store Identifier	Friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information step above, plus the port number. Example: Netskope DSPM-azure-mysql-test.mysql.database.azure.com:3306. 3306 is the default MySQL port number. If you are using a custom port number, be sure to substitute it here.
Scan Frequency	Controls how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override (if desired).
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

1. Click Next.
2. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Capability	Supported for Azure SQL DB
Discovery	Yes (always-on)
Privilege Analysis	Yes (supported for version 8.0 and above)
Shadow Data Analysis	Yes
Classification	Yes
Data In Use Monitoring	Yes Warning: Enabling query logging on a MySQL database may impact its performance. Once you have completed these configurations, closely monitor your database along with any pipelines/applications that are dependent on it.
Automation	Yes (always-on)

Step 3: Review and Save

1. Click Save.
   • When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
2. Click Save to finalize the connection.