sp_Blitz: make it install and run on Azure SQL Database (#4040)

[BrentOzar]

Closes #4040.

The bug

Azure SQL DB refuses to compile a module that names another database. The ALTER PROCEDURE aborted on the first of 88 cross-database references (model.sys.objects, sp_Blitz.sql:392) and sp_Blitz was never created.

Worse than the issue reported: the IF OBJECT_ID(...) IS NULL EXEC('CREATE PROCEDURE dbo.sp_Blitz AS RETURN 0') stub is a separate batch with no cross-DB reference, so it succeeds. Only the ALTER fails. Azure users were left with an sp_Blitz that runs, returns nothing, and raises no error — a silent clean bill of health.

The runtime @Skip* / #SkipChecks work from #3951 could never fix this. Msg 40515 fires when Azure binds the module, long before any runtime guard exists.

What changed

	Count
wrap	32	statements reading master/msdb/model/rdsadmin now run through sp_executesql
hoist	19	cross-DB sub-queries in IF predicates evaluated first into @CrossDBExists / @CrossDBCount / @CrossDBDate
localise	3	master.sys.all_objects DMV probes → plain sys.all_objects
skip list	28	CheckIDs added to the Azure skip block

A few decisions worth reviewing:

• The 3 localised probes need no dynamic SQL. They are version gates (dm_os_memory_nodes, change_tracking_databases, dm_exec_query_resource_semaphores). System objects come from the resource database and are visible in sys.all_objects from any database, so dropping the master. prefix is identical semantics — and it is what the file already does for sys.all_columns at line 1739.
• Every dynamic cross-DB call is gated on EngineEdition <> 5, and every hoisted probe that feeds a skippable check also carries that check's #SkipChecks predicate (see review fixes below). Hoisting a sub-query out of an IF costs the short-circuit that used to protect it — the RDS probe sat behind db_id('rdsadmin') IS NOT NULL — and Azure cannot execute these references even now that it can compile past them.
• @TempDBfiles became #BlitzTempDBfiles. A table variable is not visible inside sp_executesql, so it had to become a temp table; the Blitz prefix keeps it from colliding with a caller's own temp table.
• CheckID 191 reads sys.master_files in its own guard predicate, which no skip-list entry can rescue, since the predicate still has to bind. Its count is precomputed instead, starting at 0 so the <> 0 arm turns the check off on Azure.
• The 28 new skips each reach an object Azure lacks (sys.master_files, sys.servers, sys.dm_os_cluster_nodes, sys.server_permissions, …) from inside pre-existing dynamic SQL. They compiled fine and only failed on execution.

Review fixes

Six defects caught in review. The last three came from Copilot's suppressed comments, which turned out to be the valuable ones.

• CheckID 93 (8b9c783) referenced @IsWindowsOperatingSystem from inside the dynamic batch without declaring or passing it. Caller-local variables are not visible there, so every boxed run reaching this check would have raised Msg 137 and aborted. The bit is now passed as an sp_executesql parameter.
• CheckID 212 (8b9c783) ended its dynamic string immediately after IF (SELECT COUNT(*) FROM #Instances) > 1, leaving an IF with no statement inside the batch and an unconditional BEGIN outside it. Only the xp_regread call is dynamic now; the count is evaluated in the outer batch.
• CheckID 271 (6ed18f9) captured a SUM(1) file count into @CrossDBDate through a DATETIME output parameter. It uses the @CrossDBCount INT helper that already exists for this.
• CheckID 232 (5023786) was added to the skip list by mistake, silently turning off the "Data Size" finding that sp_Blitz: add Azure SQL Database support #3951 deliberately added for Azure. The check already branches on @IsAzureSQLDB and reads sys.database_files there, so it was always Azure-safe. Worth naming because nothing would have reported it: a skipped check raises no error and changes no binding, it just stops finding things.
• Hoisted probes escaped their skip guards (ee2e7b7). Moving a cross-database sub-query out of an IF predicate also moved it out from behind that check's #SkipChecks test, so asking to skip CheckID 202, 178, 105, 116 or 191 no longer prevented the cross-database read. That defeats what the skip list is for — it exists so an account without access to msdb or master metadata can turn off the checks that would fail on it, a scenario CheckID 191 spells out in its own comment. Each probe now carries the same skip predicate as the check it feeds; when skipped the helper keeps its initialised value, making the downstream condition false, which is the previous outcome. All 20 hoists were swept: 9 already sit inside their check's skip block, 4 are the TRY/CATCH permission probes that set @SkipModel / @SkipMSDB_objs / @SkipMSDB_jobs, and 2 are the RDS master.sys.all_objects reads, visible to every login.
• #TempDBfiles could destroy a caller's temp table (ee2e7b7). Caller temp tables are visible inside nested procedures, so DROP TABLE #TempDBfiles would drop a table of that name belonging to the calling session — a side effect the table variable did not have. Renamed #BlitzTempDBfiles.

Verification

Three engines, all executing the procedure rather than only installing it.

	Result
SQL Server 2017 (oldest supported)	39/39 smoke-test steps passed, no SQL errors	✅
SQL Server 2025 (newest)	39/39 smoke-test steps passed, no SQL errors	✅
Azure SQL Database (EngineEdition 5)	installs, runs clean, returns findings	✅

Boxed coverage comes from the smoke-test overhaul in #4047, which executes the kit instead of installing it with @VersionCheckMode = 1 — an unconditional early RETURN that meant no check body ever ran. Every rewritten sp_executesql block now binds and executes. Both of the first two bugs above would have failed this loudly: CheckID 93 with Msg 137 at bind time, CheckID 212 with a syntax error when sp_executesql parsed the stranded IF.

Azure is now a CI job, not a one-off manual run — .github/workflows/azure-sql-smoke-test.yml. It asserts four things rather than one, because #4040's failure mode is invisible to "did it install":

• EngineEdition is 5, so a pass cannot come from accidentally testing something that is not Azure
• both scripts install without error
• sp_Blitz's definition is longer than 10,000 characters — proving the body landed and not just the RETURN 0 stub
• it runs clean and returns at least one finding, because running silently with nothing to say is the bug, not the goal

Latest run: definition 510,178 characters, 0 errors, 30 findings across 20 CheckIDs.

The finding count is not stable, because the target is a single shared serverless database whose state moves between runs. Re-running the same commit twenty minutes later took it from 29 to 30, so the count is a liveness assertion, not a fixture. The job therefore also logs which CheckIDs fired, so a number that moves can be explained rather than guessed at.

The checks still find the same things. A throwaway harness installed dev's sp_Blitz, recorded every (CheckID, DatabaseName, Finding), then did the same for this branch and diffed. On both SQL Server 2017 and 2025 the two lists were identical — 49 findings each on 2017. Excluded four CheckIDs that cannot be stable between two runs minutes apart regardless of the code: 156 embeds GETDATE() in its text, 185 compares uptime against live counters, and 152/153 are a pair gated on wait_time_ms > .1 * @CpuMsSinceWaitsCleared, whose denominator grows with uptime. A guard required each capture to be non-empty, so an empty comparison could not pass as a match. The harness was deleted once it had answered; it is a question about this change, not a check every future PR should rerun.

Static analysis: 0 cross-database references remain outside string literals, re-verified with a lexer handling strings, -- and nested /* */ together. Every generated string literal was mechanically unescaped and diffed against the original source text; each reproduces its source exactly.

What this does not establish

• Windows-only paths. The CI containers are Linux, so @IsWindowsOperatingSystem = 0 and xp_regread — one of the two spots review found a bug in — is not exercised. A Windows host is the only coverage for those.
• Restricted-permission behaviour. The findings comparison ran as sa, where a cross-database read never fails. That is precisely why it could not have caught the skip-guard defect above, which only bites an account that lacks access to msdb or master.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FMPBMMANLaFgSQ73GTgBW7

[BrentOzar]

Review/test summary for head 4d41439:

• Azure SQL Database (EngineEdition 5): the exact PR script installed successfully. The default sp_Blitz run completed without errors and returned 29 findings. An expanded run with user-database checks and server info enabled also completed without errors and returned 37 findings.
• The existing GitHub SQL Server smoke check is green, but it only installs the procedure and exercises VersionCheckMode; it does not execute the normal check path.
• Boxed-SQL static review found two P1 execution blockers, posted inline: CheckID 93 loses @IsWindowsOperatingSystem across the dynamic-SQL scope, and CheckID 212 leaves an IF without a body inside the dynamic batch.

Azure support is working as intended, but I would not merge until both boxed-SQL regressions are fixed and the normal execution path is smoke-tested.

[Copilot]

Pull request overview

Updates sp_Blitz so it can be created/compiled and run on Azure SQL Database (EngineEdition = 5) by removing static cross-database references that Azure rejects at module-bind time, and by expanding the Azure skip list for unsupported objects.

Changes:

• Wraps cross-database metadata reads (master/msdb/model/rdsadmin) in sp_executesql so Azure SQL DB can compile the module.
• Hoists some cross-DB predicates into @CrossDB* helper variables to avoid static 3-part naming.
• Expands the Azure SQL DB #SkipChecks block to skip additional CheckIDs that would otherwise fail at execution time.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BrentOzar]

Reviewed the current head (abe4996) after the three earlier review fixes. I found no additional actionable issues.

I specifically rechecked the 53 sp_executesql calls for caller-local variables that were not passed into the dynamic batch, compared the wrapped statement bodies with the original dev text, checked the @CrossDBExists / @CrossDBCount / @CrossDBDate reset and output types, and scanned the resulting procedure for cross-database names left outside string literals. The only remaining static three-part names are the existing tempdb.sys.database_files references. The SQL Server smoke-test workflow is also green.

Residual coverage gap: I did not execute the Windows-only xp_regread path; that limitation is already called out clearly in the PR description.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Suppressed comments (6)

Previously missed (2) — in code that hasn't changed since the last review.

sp_Blitz.sql:7087

• This can drop a #TempDBfiles table created by the session that invoked sp_Blitz, because caller temp tables are visible inside nested procedures. The previous table variable had no such side effect. Use a procedure-specific temp-table name and update its references rather than dropping this generic caller-visible name.

							IF OBJECT_ID('tempdb..#TempDBfiles') IS NOT NULL DROP TABLE #TempDBfiles;
							CREATE TABLE #TempDBfiles (config VARCHAR(50), data_files INT);

sp_Blitz.sql:1821

• The CheckID 202 metadata probe runs before its #SkipChecks predicate, so globally skipping 202 no longer prevents the msdb access. Keep the probe behind the same skip guard to preserve the documented skip behavior and avoid permission failures.

This issue also appears in the following locations of the same file:

• line 1953
• line 4224
• line 4425
• line 6441

                     IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5 /* not Azure SQL DB */

sp_Blitz.sql:1953

• The hoisted CheckID 178 probe now executes before the #SkipChecks guard. A caller that globally skips 178 still scans msdb.dbo.backupset, and under an account without access to backup history this can abort sp_Blitz even though the check was explicitly skipped. Include the same skip predicate in this guard or move the probe inside the check's guarded block.

				IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5 /* not Azure SQL DB */

sp_Blitz.sql:4224

• The CheckID 105 probe executes even when 105 is globally present in #SkipChecks. Put the dynamic lookup behind the same skip predicate so a skipped check does not access master metadata.

				IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5 /* not Azure SQL DB */

sp_Blitz.sql:4425

• This msdb feature probe is outside CheckID 116's #SkipChecks guard, so requesting that 116 be skipped still performs cross-database work and can fail under restricted permissions. Apply the skip predicate before invoking sp_executesql.

						IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5 /* not Azure SQL DB */

sp_Blitz.sql:6441

• The newly hoisted CheckID 191 count is evaluated before checking whether 191 is skipped. This means a global skip no longer suppresses the catalog access; include the skip predicate in this guard, as the later IF already does.

		IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5 /* not Azure SQL DB */

[BrentOzar]

Copilot's suppressed findings on the last review turned out to be the valuable ones. Both are fixed in ee2e7b7. Recording them here since suppressed comments have no thread to reply on.

Hoisted probes escaped their skip guards

The important one. Hoisting a cross-database sub-query out of an IF predicate also moved it out from behind that check's #SkipChecks test. On dev the sub-query sat after the skip test in the same predicate, so skipping the check skipped the cross-database read with it. After the rewrite the read happened first, unconditionally:

SET @CrossDBExists = 0;
IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5
BEGIN
EXEC sys.sp_executesql N'... FROM msdb.INFORMATION_SCHEMA.COLUMNS ...';   -- ran even when 202 was skipped
END;

IF NOT EXISTS (SELECT 1 FROM #SkipChecks WHERE DatabaseName IS NULL AND CheckID = 202)

That defeats what the skip list is for. @SkipChecksTable exists so an account without access to msdb or master metadata can turn off the checks that would fail on it — and after this change, asking for that no longer prevented the access. CheckID 191 makes the scenario explicit in its own comment: "User may have no permissions to see tempdb files in sys.master_files."

Each probe now carries the same skip predicate as the check it feeds. When skipped, the helper keeps its initialised value (0 / NULL), which makes the downstream condition false — the same outcome as before.

Swept all 20 hoisted probes rather than only the 5 reported. Copilot's list was complete; the other 15 are already correct:

	Count	Why they are fine
Inside their check's skip block	9	the hoist is nested within IF NOT EXISTS(#SkipChecks …) BEGIN, so the guard already applies
TRY/CATCH permission probes	4	these are the permission-detection mechanism — they set @SkipModel / @SkipMSDB_objs / @SkipMSDB_jobs, and a failure is caught
RDS master.sys.all_objects reads	2	visible to every login, and the lost short-circuit is already disclosed in the PR description

Worth noting that this is a defect class my findings comparison could not have caught: it ran as sa, where a cross-database read never fails, so both sides produced identical output. It only bites a restricted account.

#TempDBfiles could destroy a caller's temp table

Turning the @TempDBfiles table variable into a temp table gave sp_Blitz a side effect it did not previously have. Caller temp tables are visible inside nested procedures, so DROP TABLE #TempDBfiles would destroy a table of that name belonging to the session that called sp_Blitz — and #TempDBfiles is a plausible name for someone poking at tempdb to have created. Renamed to #BlitzTempDBfiles, matching #BlitzResults.

Retry budget

Fixed and replied on the thread.

Left open deliberately

The credentials-on-pull_request thread. Forks are already excluded, and anyone who can push a same-repo branch can read a repository secret through any trigger anyway, so an environment gate alone does not change the trust boundary. The real residual — long-lived shared credentials against a shared database — needs a repository-owner decision, so I have not tried to settle it in the diff.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

sp_Blitz.sql:1824

• These new skip guards are not covered under the permission model they are meant to protect: the boxed matrix connects as sa, while Azure skips these cross-database checks entirely. A non-sysadmin regression here already occurred during this PR, so please add a smoke case using a login with VIEW SERVER STATE but no msdb access, supply skips for the hoisted checks, and assert that sp_Blitz completes without attempting those reads.

                     IF CONVERT(INT, SERVERPROPERTY('EngineEdition')) <> 5 /* not Azure SQL DB */
                     	AND NOT EXISTS ( SELECT  1
                     	                 FROM    #SkipChecks
                     	                 WHERE   DatabaseName IS NULL AND CheckID = 202 )

[BrentOzar]

Ready for review at 5fad8de. Final state:

SQL Server 2017 (oldest supported)	39/39 steps, no SQL errors
SQL Server 2025 (newest, 17.0.4075.5)	39/39 steps, no SQL errors
Azure SQL Database (EngineEdition 5)	installs at 510,178 chars, runs clean, 30 findings across 20 CheckIDs
Copilot	"reviewed 3 out of 3 changed files and generated no new comments"

Copilot's last pass raised one thing worth naming rather than burying: the new skip guards are not covered by any test, because the boxed matrix connects as sa and Azure skips those checks entirely. That is a real gap — it is why the skip-guard defect survived the boxed tests, the Azure test, a findings comparison, and three rounds of review. Filed as #4052 rather than bolted on here, because a naive version of that test is brittle: sp_Blitz does plenty as a non-sysadmin that will complain for unrelated reasons, and getting the skip list wide enough to be quiet but narrow enough to still fail when a guard is removed is the actual work.

Two other things a human reviewer should weigh in on rather than take from me:

1. Azure credentials on pull_request — thread left open deliberately. Forks are excluded and anyone who can push a same-repo branch can read a repository secret through any trigger anyway, so an environment gate alone does not move the trust boundary. The long-lived shared credential is the part worth deciding on.
2. Windows-only paths remain untested. The CI containers are Linux, so xp_regread — one of the two places review found a bug — is never exercised. Only a Windows host covers that.

---

Generated by Claude Code

[BrentOzar]

Re-reviewed the current head (5fad8de), which is 10 commits ahead of the version I previously reviewed. I found no additional actionable issues.

For the new delta, I checked the Azure workflow and smoke-test script for false-pass paths, verified the new pre-drop/zero-count assertion, and reviewed the sp_Blitz.sql changes that guard hoisted probes behind #SkipChecks, restore CheckID 232 on Azure, and rename #TempDBfiles to avoid caller collisions. I also repeated the full static three-part-name and dynamic-variable-scope scans against the current procedure.

The live Azure run for this head confirmed EngineEdition 5, started from a clean database, installed a 510,178-character sp_Blitz, ran without errors, and returned 30 findings. Both the Azure and boxed SQL Server workflows are green.

I did not duplicate the existing open thread about protecting the long-lived Azure credentials; that remains the only unresolved review concern visible on the current patch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4bb07c5ac6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".