sql-server-to-sql-mi-lrs-migration
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [Secure Authentication and Identity Management]: The skill strictly uses Microsoft Entra ID and Windows Integrated authentication, explicitly prohibiting the use of SQL passwords, SAS tokens, or storage keys. It utilizes Azure Managed Identities to grant the SQL Managed Instance read access to storage, adhering to the principle of least privilege and minimizing credential exposure.
- [Manual Confirmation Gates]: To prevent unintended mutations, the skill requires the user to manually type specific, case-sensitive phrases for high-risk operations such as SQL Agent job creation and migration cutover. This ensures a human-in-the-loop verification step for actions that affect the production environment.
- [Idempotent State Management]: The migration logic is implemented as a state machine that authoritatively re-classifies resources (as Absent, Matching, or Conflicting) before each step. This approach prevents duplicate resource creation and ensures that the system can safely recover from interruptions by verifying the actual state of Azure and SQL resources.
- [Data Redaction and Sanitization]: A dedicated utility (
migration-error.ps1) is employed to automatically redact sensitive information, such as access tokens and connection strings, from error messages and diagnostics. This protects against accidental data exposure during troubleshooting. - [Trusted Tooling and Dependencies]: The skill relies on official Microsoft tools and modules (Az PowerShell, AzCopy, and sqlcmd) sourced from trusted registries like the PSGallery and Winget. All external dependencies are standard for Azure management and are documented within the operating contract.
Audit Metadata