Merge branch 'release-dallas' of https://github.com/MicrosoftDocs/sql-docs-pr into release-dallas

Author: MikeRayMSFT

azure-sql/database/ledger-landing.yml

@@ -14,7 +14,7 @@ metadata:
   author: VanMSFT
   ms.author: vanto
   ms.reviewer: kendralittle, mathoma
-  ms.date: 05/25/2021
+  ms.date: 07/22/2022
 
 # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
 
@@ -46,6 +46,8 @@ landingContent:
             url: /sql/relational-databases/security/ledger/ledger-digest-management
           - text: Database verification
             url: /sql/relational-databases/security/ledger/ledger-database-verification
+          - text: Monitor digest uploads
+            url: /sql/relational-databases/security/ledger/ledger-monitor-digest-uploads
 
 
   # Card 
@@ -117,4 +119,15 @@ landingContent:
           - text: sys.sp_verify_database_ledger_from_digest_storage (Transact-SQL)
             url: /sql/relational-databases/system-stored-procedures/sys-sp-verify-database-ledger-from-digest-storage-transact-sql
           - text: sys.sp_copy_data_in_batches (Transact-SQL)
-            url: /sql/relational-databases/system-stored-procedures/sys-sp-copy-data-in-batches-transact-sql
+            url: /sql/relational-databases/system-stored-procedures/sys-sp-copy-data-in-batches-transact-sql
+
+
+  # Card 
+  - title: Ledger video references
+    linkLists:
+      - linkListType: video
+        links:
+          - text: Bringing the power of blockchain to Azure SQL Database and SQL Server with ledger | Data Exposed
+            url: https://docs.microsoft.com/shows/data-exposed/bringing-the-power-of-blockchain-to-azure-sql-database-and-sql-server-with-ledger-data-exposed
+          - text: Learn how Lenovo reinforces trust using ledger in Azure SQL Database
+            url: https://videos.microsoft.com/customer-stories/watch/xEenNHQerYdRyYqwdYLyXi

azure-sql/toc.yml

@@ -469,6 +469,10 @@
             href: /sql/relational-databases/security/ledger/ledger-digest-management
           - name: Database verification
             href: /sql/relational-databases/security/ledger/ledger-database-verification
+          - name: Monitor digest uploads
+            href: /sql/relational-databases/security/ledger/ledger-monitor-digest-uploads
+          - name: Recover ledger database after tampering
+            href: /sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering
           - name: Ledger limitations
             href: /sql/relational-databases/security/ledger/ledger-limits
         - name: Network access controls

docs/relational-databases/security/ledger/ledger-digest-management.md

@@ -1,7 +1,7 @@
 ---
 title: "Digest management"
 description: This article provides information on digest management for a ledger database.
-ms.date: "05/24/2022"
+ms.date: "07/22/2022"
 ms.service: sql-database
 ms.subservice: security
 ms.custom:
@@ -30,15 +30,46 @@ The verification process and the integrity of the database depend on the integri
 ### Automatic generation and storage of database digests
 
 > [!NOTE]
-> Automatic generation and storage of database digests is currently available in Azure SQL Database, but not supported on SQL Server.
+> Automatic generation and storage of database digests in SQL Server only supports Azure Storage accounts.
 
 Ledger integrates with the [immutable storage feature of Azure Blob Storage](/azure/storage/blobs/immutable-storage-overview) and [Azure Confidential Ledger](/azure/confidential-ledger/index). This integration provides secure storage services in Azure to help protect the database digests from potential tampering. This integration provides a simple and cost-effective way for users to automate digest management without having to worry about their availability and geographic replication.  Azure Confidential Ledger has a stronger integrity guarantee for customers who might be concerned about privileged administrators access to the digest. [This table](/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage) compares the immutable storage feature of Azure Blob Storage with Azure Confidential Ledger.  
 
-You can configure automatic generation and storage of database digests through the Azure portal, PowerShell, or the Azure CLI. For more information, see [Enable automatic digest storage](ledger-how-to-enable-automatic-digest-storage.md). When you configure automatic generation and storage, database digests are generated on a predefined interval of 30 seconds and uploaded to the selected storage service. If no transactions occur in the system in the 30-second interval, a database digest won't be generated and uploaded. This mechanism ensures that database digests are generated only when data has been updated in your database. When the endpoint is an Azure Blob Storage, the database server will create a new container, named **sqldbledgerdigests** and use a naming pattern like:
-ServerName/DatabaseName/CreationTime. The creation time is needed because a database with the same name can be dropped and recreated or restored, allowing for different “incarnations” of the database under the same name. See [Digest Management Considerations](ledger-digest-management.md)
+You can configure automatic generation and storage of database digests through the Azure portal, PowerShell, or the Azure CLI. For more information, see [Enable automatic digest storage](ledger-how-to-enable-automatic-digest-storage.md). When you configure automatic generation and storage, database digests are generated on a predefined interval of 30 seconds and uploaded to the selected storage service. If no transactions occur on the system in the 30-second interval, a database digest won't be generated and uploaded. This mechanism ensures that database digests are generated only when data has been updated in your database. When the endpoint is an Azure Blob Storage, the Azure SQL database server will create a new container, named **sqldbledgerdigests** and use a naming pattern like:
+ServerName/DatabaseName/CreationTime. The creation time is needed because a database with the same name can be dropped and recreated or restored, allowing for different “incarnations” of the database under the same name. See [Digest Management Considerations](ledger-digest-management.md).
 
-> [!IMPORTANT]
-> If you use Azure Blob Storage, configure an [immutability policy](/azure/storage/blobs/immutable-policy-configure-version-scope) on your container after provisioning to ensure that database digests are protected from tampering.
+> [!NOTE]
+> For SQL Server, the container needs to be created manually by the user.
+
+#### Azure Storage Account Immutability Policy
+
+If you use an Azure Storage account for the storage of the database digests, configure an [immutability policy](/azure/storage/blobs/immutable-policy-configure-version-scope) on your container after provisioning to ensure that database digests are protected from tampering. Make sure the immutability policy allows protected append writes to append blobs and that the policy is locked.
+
+#### Azure Storage account permission
+
+If you use **Azure SQL Database**, make sure that your logical server (System Identity) has sufficient RBAC permissions to write digests by adding it to the [Storage Blob Data Contributor](/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor) role.
+
+If you use **SQL Server**, you have to create a shared access signature (SAS) key on the digest container to allow SQL Server to connect and authenticate against the Azure Storage account.
+
+- Create a container on the Azure Storage account, named **sqldbledgerdigests**.
+- Create a policy on a container with the *Read*, *Add*, *Create*, *Write*, and *List* permissions, and generate a shared access signature key.
+- For each container used for digest file storage, create a [SQL Server credential](/sql/relational-databases/security/authentication-access/credentials-database-engine) whose name matches the container path.
+
+The following example assumes that an Azure Storage container, a policy, and a SAS key have been created. This is needed by SQL Server to access the digest files in the container.
+
+In the following code snippet, replace `<your SAS key>` with the SAS key. The SAS key will look like `'sr=c&si=<MYPOLICYNAME>&sig=<THESHAREDACCESSSIGNATURE>'`.
+
+```sql
+CREATE CREDENTIAL [https://ledgerstorage.blob.core.windows.net/sqldbledgerdigests]  
+WITH IDENTITY='SHARED ACCESS SIGNATURE',  
+SECRET = '<your SAS key>'   
+```  
+
+#### Azure Confidential Ledger Permission
+
+If you use **Azure SQL Database**, make sure that your logical server (System Identity) has sufficient RBAC permissions to write digests by adding it to the **Contributor** role.
+
+> [!NOTE]
+> Automatic generation and storage of database digests in SQL Server only supports Azure Storage accounts.
 
 ### Manual generation and storage of database digests
 
@@ -64,19 +95,19 @@ The returned result set is a single row of data. It should be saved to the trust
 ```
 
 ## Digest management considerations
-> [!NOTE]
-> This section only applies to Azure SQL Database, and not SQL Server.
 
 ### Database restore
 
-Restoring the database back to an earlier point in time, also known as [Point in Time Restore](/azure/azure-sql/database/recovery-using-backups#point-in-time-restore), is an operation frequently used when a mistake occurs and users need to quickly revert the state of the database back to an earlier point in time. When uploading the generated digests to Azure Storage or Azure Confidential Ledger, the *create time* of the database is captured that these digests map to. Every time the database is restored, it's tagged with a new *create time* and this technique allows us to store the digests across different “incarnations” of the database. Ledger preserves the information regarding when a restore operation occurred, allowing the verification process to use all the relevant digests across the various incarnations of the database. Additionally, users can inspect all digests for different create times to identify when the database was restored and how far back it was restored to. Since this data is written in immutable storage, this information will be protected as well.
+Restoring the database back to an earlier point in time, also known as [Point in Time Restore](/azure/azure-sql/database/recovery-using-backups#point-in-time-restore), is an operation frequently used when a mistake occurs and users need to quickly revert the state of the database back to an earlier point in time. When uploading the generated digests to Azure Storage or Azure Confidential Ledger, the *create time* of the database is captured that these digests map to. Every time the database is restored, it's tagged with a new *create time* and this technique allows us to store the digests across different “incarnations” of the database. For SQL Server, the *create time* is the current UTC time when the digest upload is enabled for the first time. Ledger preserves the information regarding when a restore operation occurred, allowing the verification process to use all the relevant digests across the various incarnations of the database. Additionally, users can inspect all digests for different create times to identify when the database was restored and how far back it was restored to. Since this data is written in immutable storage, this information will be protected as well.
 
-### Active geo-replication
+### Active geo-replication and Always On Availability Groups
 
-Replication across geographic regions is asynchronous for performance reasons and, thus, allows the secondary database to be slightly behind compared to the primary. In the event of a geographic failover, any latest data that hasn't yet been replicated is lost. Ledger will only issue database digests for data that has been replicated to geographic secondaries to guarantee that digests will never reference data that might be lost in case of a geographic failover. This only applies for automatic generation and storage of database digests.
+Active geo-replication can be configured for an Azure SQL Database. Replication across geographic regions is asynchronous for performance reasons and, thus, allows the secondary database to be slightly behind compared to the primary. In the event of a geographic failover, any latest data that hasn't yet been replicated is lost. Ledger will only issue database digests for data that has been replicated to geographic secondaries to guarantee that digests will never reference data that might be lost in case of a geographic failover. This only applies for automatic generation and storage of database digests.
 
 Dropping the link between the primary and the secondaries when ledger digests are configured isn't supported. You should first disable the *Enable automatic digest storage* database setting, remove the synchronization between the primary and the secondary and re-enable the *Enable automatic digest storage* database setting.
 
+When your database is part of an Always On Availability Group in SQL Server, the same principle as active geo-replication is used. The upload of the digests is only done if all transactions have been replicated to the secondary replicas.
+
 ## Next steps
 
 - [Ledger overview](ledger-overview.md)

docs/relational-databases/security/ledger/ledger-how-to-enable-automatic-digest-storage.md

@@ -10,14 +10,17 @@ ms.topic: how-to
 author: VanMSFT
 ms.author: vanto
 ms.reviewer: kendralittle, mathoma
-ms.date: "05/24/2022"
+ms.date: "07/22/2022"
 monikerRange: "= azuresqldb-current"
+zone_pivot_groups: as1-azuresql-sql
 ---
 
 # Enable automatic digest storage
 
 [!INCLUDE [Azure SQL Database](../../../includes/applies-to-version/asdb.md)]
 
+::: zone pivot="as1-azure-sql-database"
+
 In this article, we'll describe how you can configure automatic generation and storage of database digests through the Azure portal, PowerShell, or the Azure CLI.
 
 ## Prerequisites
@@ -79,6 +82,35 @@ az sql db ledger-digest-uploads enable \
 ```
 
 ---
+::: zone-end
+
+::: zone pivot="as1-sql-server"
+
+In this article, we'll describe how you can configure automatic generation and storage of database digests through using T-SQL in **SQL Server 2022**. For information on configuring automatic generation and storage of database digests in Azure SQL Database, use the switch at the top of this page to toggle over to Azure SQL Database.
+
+## Prerequisites
+
+- SQL Server 2022
+- [SQL Server Management Studio (SSMS)](/sql/ssms/download-sql-server-management-studio-ssms) or [Azure Data Studio](/sql/azure-data-studio/download-azure-data-studio)
+- An Azure Blob Storage
+- An Azure Storage container
+- A [SQL Server credential](/sql/relational-databases/security/authentication-access/credentials-database-engine). For more information, see [Digest Management](ledger-digest-management.md).  
+
+## Enable database digest uploads using T-SQL
+
+To enable uploading ledger digests, specify the endpoint of an Azure Blob storage account. To disable uploading ledger digests, set the option value to `OFF`. The default is `OFF`.
+
+1. Sign into your SQL Server 2022 instance using SSMS or Azure Data Studio.
+1. Configure automatic generation and storage of database digests using the following T-SQL statement:
+
+   ```sql
+   ALTER DATABASE SCOPED CONFIGURATION
+    SET LEDGER_DIGEST_STORAGE_ENDPOINT = 'https://mystorage.blob.core.windows.net';
+   ```
+
+For more information, see [ALTER DATABASE SCOPED CONFIGURATION (Transact-SQL)](/sql/t-sql/statements/create-database-transact-sql).
+
+::: zone-end
 
 ## Next steps
 

docs/relational-databases/security/ledger/ledger-landing-sql-server.yml

@@ -12,13 +12,11 @@ metadata:
   ms.devlang:
   ms.custom:
   - event-tier1-build-2022
-  - event-tier1-build-2022
-  - event-tier1-build-2022
   ms.topic: landing-page
   author: VanMSFT
   ms.author: vanto
   ms.reviewer: kendralittle, mathoma
-  ms.date: 05/24/2022
+  ms.date: 07/22/2022
   monikerRange: "= azuresqldb-current||>= sql-server-ver16||>= sql-server-linux-ver16"
   titleSuffix: SQL Server and Azure SQL Database
 # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
@@ -51,6 +49,8 @@ landingContent:
             url: ledger-digest-management.md
           - text: Database verification
             url: ledger-database-verification.md
+          - text: Monitor digest uploads
+            url: ledger-monitor-digest-uploads.md
 
 
   # Card 
@@ -118,4 +118,16 @@ landingContent:
           - text: sys.sp_verify_database_ledger_from_digest_storage (Transact-SQL)
             url: ../../system-stored-procedures/sys-sp-verify-database-ledger-from-digest-storage-transact-sql.md
           - text: sys.sp_copy_data_in_batches (Transact-SQL)
-            url: ../../system-stored-procedures/sys-sp-copy-data-in-batches-transact-sql.md
+            url: ../../system-stored-procedures/sys-sp-copy-data-in-batches-transact-sql.md
+
+
+  # Card 
+  - title: Ledger video references
+    linkLists:
+      - linkListType: video
+        links:
+          - text: Bringing the power of blockchain to Azure SQL Database and SQL Server with ledger | Data Exposed
+            url: https://docs.microsoft.com/shows/data-exposed/bringing-the-power-of-blockchain-to-azure-sql-database-and-sql-server-with-ledger-data-exposed
+          - text: Learn how Lenovo reinforces trust using ledger in Azure SQL Database
+            url: https://videos.microsoft.com/customer-stories/watch/xEenNHQerYdRyYqwdYLyXi
+

docs/relational-databases/security/ledger/ledger-monitor-digest-uploads.md

@@ -0,0 +1,51 @@
+---
+title: "Monitor digest uploads"
+description: This article provides information on monitoring the digest uploads for ledger.
+ms.date: "07/25/2022"
+ms.service: sql-database
+ms.subservice: security
+ms.custom:
+ms.reviewer:
+ms.topic: conceptual
+author: VanMSFT
+ms.author: vanto
+monikerRange: "= azuresqldb-current||>= sql-server-ver16||>= sql-server-linux-ver16"
+zone_pivot_groups: as1-azuresql-sql
+---
+
+# Monitor digest uploads
+
+[!INCLUDE [SQL Server 2022 Azure SQL Database](../../../includes/applies-to-version/sqlserver2022-asdb.md)]
+
+::: zone pivot="as1-azure-sql-database"
+
+You can monitor failed and successful ledger digest uploads in the [Azure portal](https://portal.azure.com) in the **Metrics** view of your Azure SQL Database.
+
+:::image type="content" source="media/ledger/monitor-ledger-digest-uploads.png" alt-text="Metrics view of the Azure SQL Database failed and successful ledger digest uploads in the Azure portal.":::
+
+::: zone-end
+
+::: zone pivot="as1-sql-server"
+
+You can monitor failed and successful ledger digest uploads with [Extended Events](../../extended-events/extended-events.md) in SQL Server. Select the events *ledger_digest_upload_failed* and *ledger_digest_upload_success* in the Extended Event session.
+
+::: zone-end
+
+## Digest upload alerts recommendation
+
+::: zone pivot="as1-azure-sql-database"
+
+We recommend you configure alerts on failed ledger digest uploads if you want to be notified when a digest upload failed. Failures might occur due to revoked permissions on the storage account or network configuration that makes the storage account inaccessible. Optionally, you could also configure an alert on successful ledger digest uploads. If the number of successful ledger digest uploads drops under a certain value or zero due to someone disabling the automatic digest upload, the alert can help raise attention to this matter. Digest uploads that are explicitly disabled wouldn't be considered a failure in this case.
+
+::: zone-end
+
+::: zone pivot="as1-sql-server"
+
+We recommend you configure an alert on event number *37417 - Uploading ledger digest failed*. The alert can be configured using [SQL Agent Alert](../../../ssms/agent/create-an-alert-using-an-error-number.md) or your favorite third-party monitoring tool.
+
+::: zone-end
+
+## Next steps
+
+- [Ledger overview](ledger-overview.md)
+- [Enable automatic digest storage](ledger-how-to-enable-automatic-digest-storage.md)