Oracle Cloud Infrastructure Documentation

Register On-Premises Oracle Databases by Using Enterprise Manager

You can register a group of on-premises Oracle databases defined in Enterprise Manager with Oracle Data Safe by using the Enterprise Manager Data Safe onboarding API.

The supported version of Enterprise Manager is Enterprise Manager 24ai Release 1, RU 11.

Note

Note: Registration is free during the on-premises target database promotion until February 2027. After that, you will be charged for your registered on-premises Oracle databases in Oracle Data Safe.

Preregistration Tasks

The following table lists the preregistration tasks.

Task Number Task Link to Instructions
1 Obtain a paid OCI tenancy with UCM credits. Buy an Oracle Cloud Subscription
2 Set up connectivity between your on-premises network and Oracle Cloud Infrastructure. To do this, you need to install an Oracle Data Safe on-premises connector in your on-premises environment where Enterprise Manager is installed. The on-premises connector then establishes a TLS tunnel from your network to OCI, which Oracle Data Safe uses to connect to your databases. Record the OCID of the Oracle Data Safe on-premises connector. You will need it when you register the database group. Create an Oracle Data Safe On-Premises Connector
3 Create a group of on-premises Oracle databases in Enterprise Manager. Creating and Editing Groups
4 Create a named OCI credential in Enterprise Manager. When creating the credential, select Oracle Cloud Infrastructure for the Authenticating Target Type. Configuring and Using Target Credentials
5 Create a named database credential in Enterprise Manager. When creating the credential, select Database Instance for the Authenticating Target Type, and set the Scope to Global. Configuring and Using Target Credentials

Register an Enterprise Manager Database Group with Oracle Data Safe

Ensure that you have completed the prerequisite tasks described earlier in this topic before sending the API request.

  1. Open an API client, such as Postman or Insomnia, or use a command-line HTTP client such as cURL.

  2. Send the following POST request to register the target database group. Replace the placeholder values in the request URL and request body with values from your environment. Authenticate the request by using an Enterprise Manager user account with sufficient privileges to register target databases.

    POST URL:

    https://<host>:5416/em/api/databases/dataSafeOnboarding/actions/registerTargetDatabaseGroup

    Request body:

    {
    "dbTargetGroupName": "MyDatabaseGroupEM",
    "region": "us-phoenix-1",
    "ecCredentialName": "OCI_NAMED_CRED",
    "dataSafeConnectorId": "ocid1.datasafeonpremconnector.oc1.phx....",
    "ociCompartmentId": "ocid1.compartment.oc1....",
    "dsSysNamedCredentialName": "NAMED_DB_CRED"
}

    The following table describes the request body properties.

    Property Name Value
    dbTargetGroupName Name of the Enterprise Manager database group
    region OCI region identifier for your tenancy
    ecCredentialName Name of the OCI credential that you created in Enterprise Manager
    dataSafeConnectorId OCID of the Oracle Data Safe on-premises connector
    ociCompartmentId OCID of the OCI compartment
    dsSysNamedCredentialName Name of the database credential that you created in Enterprise Manager. If preferred credentials are configured for the databases, this property is optional.

    If the request succeeds, the API returns a response similar to the following:

    {
    "message": "Successfully submitted Data Safe registration procedure.",
    "procedureName": "datasafe_registration_procedure",
    "submissionId": "...",
    "timeSubmitted": "2026-06-29T11:15:14.066-05:30"
}

    The API request performs the following actions:

    • Connects to Oracle Data Safe using the specified on-premises connector.

    • Creates the Oracle Data Safe service account (DATASAFE$ADMIN) and grants the Oracle Data Safe roles (ASSESSMENT, AUDIT_COLLECTION, AUDIT_SETTING, DATA_DISCOVERY) on each database.

    • Registers each database in the Enterprise Manager database group with Oracle Data Safe. If any database in the group is already registered, the API returns an error and stops the registration process.

    • Creates a target database group in Oracle Data Safe with the same name and databases as the Enterprise Manager database group.

    • Assigns the databases to the target database group in Oracle Data Safe.

    After the target databases are registered, Oracle Data Safe automatically generates a security assessment and user assessment for each target database in the group.

Verify Registration

Verify the Procedure Status in Enterprise Manager

Return to Enterprise Manager and verify the status of the registration job.

  1. From the hamburger menu, select Enterprise, Jobs and Procedures, and then Procedure Activity.

  2. Locate the latest job submitted, and wait for the status to change to Succeeded.

  3. (Optional) If the job is still Running, you can select Running to view the status of each procedure.

  4. Wait a few minutes for the registration to complete in Oracle Data Safe.

Verify the Registration in Oracle Data Safe

  1. Sign in to Oracle Cloud Infrastructure.

  2. From the navigation menu, select Oracle AI Database, and then under Data Safe - Database Security, select Overview.

  3. Verify that the target databases are associated with your on-premises connector:

    a) In the left navigation pane, expand Target databases, and then select On-premises connectors.

    b) If needed, select your compartment.

    c) Select the name of your on-premises connector.

    d) Select the Target databases tab and view the list of target databases associated with the on-premises connector. This list should match the list of databases in the Enterprise Manager database group.

  4. Verify the target database group and its members:

    a) In the left navigation pane, navigate to Target Database Groups.

    b) Select your compartment.

    c) Select the name of your target database group. The target database group has the same name as the Enterprise Manager database group.

    d) Select the Target database group members tab to view the list of target databases in the group.

  5. View the latest security assessment or user assessment for one of the target databases in the group:

    a) On the Target database group members tab, select the name of one of your target databases.

    b) Under Assessment, select View details for the latest security assessment or latest user assessment.

Post Registration Tasks

The following table lists tasks that you can run after registering the target databases.

Task Number Task Link to Instructions
1 (Optional) Change which features are allowed for the Oracle Data Safe service account on your target database by granting/revoking roles from the account. You need to be the SYS user. Grant Roles to the Oracle Data Safe Service Account on Your Target Database
2 (Optional) Grant users access to Oracle Data Safe features with the target database by configuring policies in Oracle Cloud Infrastructure Identity and Access Management. Create IAM Policies for Oracle Data Safe Users
3 Oracle recommendation when using an on-premises connector: Configure the INVITED_NODES parameter in the sqlnet.ora file to allow connections only from authorized on-premises clients. This helps ensure that only approved on-premises clients can connect to your on-premises Oracle database. TCP.INVITED_NODES (Oracle AI Database Net Services Reference guide)

Related Topics