Configure Compose

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

Core Connector Core connectors are included with all Alation platform tiers (subject to each tier’s connector limits) and are fully supported by Alation.

To configure the use of Compose with your Azure SQL DB OCF data source, go to the Compose tab on the Settings page of your Azure SQL DB OCF data source. For more details, see Configure Compose for OCF Data Sources.

Note

User impersonation in Compose with a kerberized account is not supported yet.

Configure OAuth Authentication for Compose Queries

Available from version 2026.7.0.0 with Azure SQL DB OCF connector version 1.7.0 or later.

Important

You need the Server Admin role in Alation to perform the steps in this section.

Enable per-user OAuth authentication for Compose queries so that each Composer authenticates to Azure SQL DB with their own Microsoft Entra ID (formerly Azure AD) identity instead of a shared service-account credential. The connector forwards the user’s access token to the database through the JDBC accessToken parameter.

Prerequisites

Before you configure OAuth authentication for Compose:

  1. Register an application in Microsoft Entra ID and grant it the required permissions to access your Azure SQL DB instance. The application must support the authorization code flow with Proof Key for Code Exchange (PKCE). For step-by-step instructions, see the Microsoft documentation: Quickstart: Register an application with the Microsoft identity platform.

  2. Create an OAuth configuration on the Admin Settings > Authentication page under Authentication Configuration Methods for External Systems. For step-by-step instructions, see Authentication Configuration Methods for External Systems.

Attach an OAuth Configuration to the Data Source

After creating the OAuth configuration, attach it to your Azure SQL DB data source:

  1. Open your Azure SQL DB data source.

  2. Go to the Compose Settings tab on the Settings page of your Azure SQL DB data source.

  3. In the External Auth Configuration section, select the OAuth configuration you created in Admin Settings.

  4. Click Save.

Composer Sign-in Experience

When a user switches to the Compose tab on this data source, Alation prompts them to sign in with their Microsoft Entra ID credentials. After they consent, Alation obtains an access token and uses it to run queries on their behalf. The access token is refreshed automatically before it expires.

Note

To remove the OAuth configuration from this data source, return to External Auth Configuration in Compose Settings, select None, and click Save. Existing Compose sessions remain active until users sign out or refresh their browser tab.

Create Tables and Views in Compose

To ensure the successful incremental MDE from Compose, use fully qualified table names when creating tables. For Alation to incrementally extract views created in Compose, both the service account connection JDBC URI and the Compose connection URI should include the database parameter. For more information on the URI format, see JDBC URI above.

Example SQL for CREATE TABLE:

CREATE TABLE <DATABASE>.<SCHEMA>.<TABLE> ({column properties});

Example SQL for CREATE VIEW:

USE <DATABASE>;
CREATE VIEW <SCHEMA>.<VIEW> AS {view condition};