Insights

Copilot can already write your SQL. Here is what to govern first

Your database administrator has not been the only one who can talk to your database for over a year now. Whether that is good news or a governance gap depends on what you do next.

Microsoft Copilot in Azure SQL Database went generally available back in April 2025, and Copilot in SQL Server Management Studio brings the same natural-language help to administrators working locally. Both let someone describe what they want in plain English and get working T-SQL back, or ask an existing query to explain itself. If your business has never reviewed what either can actually see or do, this is worth revisiting now.

What Copilot actually does in your database

Chat pane queries. Ask a question about your data in plain language and Copilot generates the T-SQL, grounded in your actual schema, documentation and query history rather than a generic guess.
Query explanations. Existing queries get explained back to you in plain-English comments, useful for anyone inheriting old code with no documentation.
Database Instructions. You can store your business rules and naming conventions as extended properties, and Copilot applies them consistently every time it answers instead of guessing at your conventions from scratch.
SSMS Copilot. The same assistance, built into SQL Server Management Studio, for administrators who work locally rather than in the Azure portal.

Copilot skills in Azure SQL Database are offered at no additional cost, which is exactly why adoption tends to move faster than governance.

The part worth pausing on

Microsoft’s own July 2026 Azure Database security guidance is direct about this: AI agents are changing how applications reach your data, and that changes what identity, access and monitoring need to look for. A chat interface that can read your schema and write queries against it is,

It’s functionally, a new way into your data. It deserves the same scrutiny you would give a new employee requesting a database login, not a free pass because it is a Microsoft feature.

Do this first: confirm Copilot’s database access follows least privilege before anyone points it at a production environment. Review which roles can invoke it, what data those roles can already see, and whether your existing monitoring would actually flag unusual query activity generated through Copilot rather than a person.

Where to start

Audit who has Copilot access today. It may already be switched on for more people than you realise.
Set Database Instructions before you scale usage. Consistent, correct answers start with the business context you give it, not the model itself.
Fold Copilot activity into your existing data-access monitoring. If your logging cannot currently distinguish a Copilot-generated query from a human one, that is the gap to close.

If you want a hand setting this up properly, from access controls to Database Instructions, our team works with Azure SQL environments every week. Talk to us about your data estate.

Specialists in Business Applications, Modern Workplace and Azure. Let’s grow.

Sources: Microsoft Learn, “Microsoft Copilot in Azure with Azure SQL Database” and Azure Database Security Newsletter (July 2026). Feature availability accurate as of July 2026 and may change as the rollout continues.