Installing and Configuring SQL Server

This topic only applies to Secret Server On-Premises.

For step-by-step instructions on how to install SQL 2016, see SQL Server 2016 Standard Edition Installation.

Secret Server requires Microsoft SQL Server as the back-end database. All editions, including the Express version, of 2016–2025 are supported.

SQL Server 2025 is supported by Secret Server 12.1.000003 or later.
Delinea does not support using SQL Express in a production environment due to size and performance limitations.

Setting up SQL Server requires:

  • Installing an SQL Server
  • Creating an SQL Account
  • Configuring database access in Secret Server
  • Installing SQL Server
If you are using SQL Express make sure to get the edition with tools that will include SQL Management Studio. Follow the link in the .
Before installing the SQL server, please make sure that the "no count" SQL Server connection property is turned off. If this setting is turned on, no Secret Server jobs will execute.

Creating an SQL Account

SQL Authentication

The fastest method to get started with Secret Server is to create a SQL Authentication account. Follow the instructions in the Database section of the Basic (Automatic) Installation.

For troubleshooting and configuring SQL installation on a different server that the application server see SQL Server Authentication Configuration article.

Windows Authentication

A more advanced way to have Secret Server access the SQL server would be through a service account and using Windows Authentication. Because of the requirement of a service account and added IIS settings, we only recommend this for non-evaluation setups. See instructions in Configuring Integrated Windows Authentication.

Microsoft Entra ID

If your database is hosted on Azure SQL Database or Azure SQL Managed Instance, Secret Server can authenticate with Microsoft Entra ID (formerly Azure AD) instead of a SQL login or a Windows service account. See Microsoft Entra ID Integrated Authentication.

Configuring Database Access in Secret Server

Once the account has been created and SQL Server is installed, the web installer asks for the database connection details. On a new installation, browse to Secret Server from the web server itself (for example, http://localhost/SecretServer) and click Install Secret Server on the Unable to access database page. The SQL Server configuration page (/app/#/install/setup-database) opens. The same page, opened with Configure database, reconnects Secret Server to an existing database. For the complete installation procedure, see Advanced (Manual) Installation.

SQL Server Configuration

  • Server name: If it is a local machine the server name will be (local) or localhost for the default instance, or if a named instance such as SQL Express it would be localhost\SQLExpress. If you are unsure, copy the value from the "Server name" text box when connecting through SQL Management Studio.
  • Database name: If you have created a database, enter the name. If you have given the SQL account dbCreator permission, enter a database name for Secret Server to create.

SQL Authentication

Select one of the following options. The names below are the labels shown in the installer.

  • Windows Authentication using Application Identity (recommended): The identity of the IIS application pool accesses the database. The installer shows that identity in parentheses after the label. This requires a domain service account that has been granted access to run ASP.NET and the database. No user name or password is entered. This is an advanced setting that is not recommended for evaluations. Follow the instructions on using a service account in Configuring Integrated Windows Authentication.
  • Azure Active Directory Authentication using Application Identity: Connects to Azure SQL with the user name and password of a Microsoft Entra ID (formerly Azure AD) account. Username and Password fields appear when you select it. This method depends on a deprecated Microsoft library and is not recommended for production use. See the Important note at the end of this topic.
  • Microsoft Entra ID (password): Connects to Azure SQL with Microsoft Entra ID integrated authentication, using the Windows identity of the IIS application pool. Despite the label, no user name or password is entered. See Microsoft Entra ID Integrated Authentication.
  • SQL Server authentication: Implies a SQL account has been created that exists only with SQL Server. Username and Password fields appear when you select it. The account will need to be dbOwner on the database or need dbOwner permission to create the database. This is recommended for quickest setup and requires SQL Server mixed mode. For more detailed information and troubleshooting see SQL Server Authentication Configuration.
If the application pool identity cannot write to the installation folder, a Disk access section appears on the page. Grant the identity read and write access to the folder and retry, or enter an Override user ID and Override password that the installation process can use.

Advanced Configuration

These settings are optional and should only be changed if you are certain your SQL Server instance is configured to use them.

  • TLS encryption: Encrypts the connection between Secret Server and SQL Server. See Enabling SQL Server Encryption.
  • Always trust server certificate: When TLS encryption is enabled, bypasses validation of the SQL Server certificate, because SQL Server often has a self-signed certificate.
  • Failover partner: The mirror server for SQL Server database mirroring. See SQL Server Mirroring.
  • Multi-subnet failover: Enable for AlwaysOn Availability Groups. Requires SQL Server 2012 or later with AlwaysOn enabled.
  • Connection timeout (seconds): How long Secret Server waits for a connection to SQL Server before reporting a failure.
We suggest to setup the database maintenance to regularly backup the transaction log for the Secret Server database to prevent system down issues. Once the log fills up, it may cause Secret Server to go down. Check Managing Full SQL Server Transaction Logs for more details.
Microsoft Entra ID (formerly Azure AD) password authentication, the Azure Active Directory Authentication using Application Identity option, depends on a deprecated Microsoft library and is not recommended for production use. Use Windows Authentication, SQL Server authentication, or Microsoft Entra ID Integrated Authentication instead.