You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Service name | Display name | Process name | Description |
43
+
| :----- | :----- | :----- | :----- |
44
+
| SqlServerExtension |Microsoft Sql Server Extension Service | SqlServerExtension.exe | Connects your SQL Server instance to Azure. |
45
+
| himds | Azure Hybrid Instance Metadata Service |`himds.exe`| Synchronizes metadata with Azure and hosts a local REST API for extensions and applications to access the metadata and request Microsoft Entra managed identity tokens |
46
+
| GCArcService | Machine configuration Arc Service |`gc_arc_service.exe` (gc_service.exe earlier than version 1.36) | Audits and enforces Azure machine configuration policies on the machine. |
47
+
| ExtensionService | Machine configuration Extension Service |`gc_extension_service.exe` (gc_service.exe earlier than version 1.36) | Installs, updates, and manages extensions on the machine. |
48
+
49
+
## Virtual service accounts
50
+
51
+
| Virtual Account | Description |
52
+
|------------------|-------------|
53
+
|`NT SERVICE\himds`| Unprivileged account used to run the Hybrid Instance Metadata Service. |
54
+
|`NT Service\SQLServerExtension`| Unprivileged account used to run the SQL Server Extension Service in least privilege mode. |
Copy file name to clipboardExpand all lines: docs/sql-server/azure-arc/backup-local.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -100,7 +100,7 @@ If you use Azure extension for SQL Server [version 1.1.2504.99](release-notes.md
100
100
101
101
Automated backups are disabled by default.
102
102
103
-
After you assigned permissions, you can schedule automated backups. After the automated backups are configured, the Arc SQL extension initiates a backup to the default backup location.
103
+
After you assigned permissions, you can schedule automated backups. After the automated backups are configured, the Azure Extension for SQL Server initiates a backup to the default backup location.
104
104
105
105
The backups are native SQL Server backups, so all backup history is available in the backup related tables in the msdb database.
Copy file name to clipboardExpand all lines: docs/sql-server/azure-arc/manage-availability-group.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -43,7 +43,7 @@ Azure portal displays the health and status of the Always on Availability Group
43
43
- Failover mode
44
44
- Synchronization state
45
45
46
-
When the availability group (AG) dashboard loads, fetching the dashboard details is done via a roundtrip down to the [!INCLUDE [ssazurearc](../../includes/ssazurearc.md)] instance. The Arc SQL extension agent connects to the SQL Server, queries the AG related DMV (Dynamic Management Views) metadata, and sends the information back to the Azure portal where it is displayed.
46
+
When the availability group (AG) dashboard loads, fetching the dashboard details is done via a roundtrip down to the [!INCLUDE [ssazurearc](../../includes/ssazurearc.md)] instance. The Azure Extension for SQL Server connects to the SQL Server instance, queries the AG related DMV (Dynamic Management Views) metadata, and sends the information back to the Azure portal where it is displayed.
This article describes how to configure a managed identity for SQL Server enabled by Azure Arc.
19
+
This article describes how to configure a managed identity for SQL Server enabled by Azure Arc.
20
20
21
21
[!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] includes managed identity support for SQL Server on Windows. Use a managed identity to interact with resources in Azure by using Microsoft Entra authentication.
22
22
23
-
> [!NOTE]
23
+
> [!NOTE]
24
24
> Using a managed identity with SQL Server 2025 is currently in **preview**.
25
25
26
-
## Overview
26
+
## Overview
27
27
28
28
[!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] introduces support for [Microsoft Entra managed identities](/entra/identity/managed-identities-azure-resources/overview). Use managed identities to authenticate to Azure services without needing to manage credentials. Managed identities are automatically managed by Azure and can be used to authenticate to any service that supports Microsoft Entra authentication. With [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], you can use managed identities both to authenticate inbound connections, and also to authenticate outbound connections to Azure services.
29
29
30
30
When you connect your SQL Server instance to Azure Arc, a system-assigned managed identity is automatically created for the SQL Server hostname. After the managed identity is created, you must associate the identity with the SQL Server instance and the Microsoft Entra tenant ID by updating the registry.
31
31
32
32
When using managed identity with SQL Server enabled by Azure Arc, consider the following:
33
+
33
34
- The managed identity is assigned at the Azure Arc server level.
34
-
- Only system-assigned managed identities are supported.
35
+
- Only system-assigned managed identities are supported.
35
36
- SQL Server uses this Azure Arc server level managed identity as the **primary managed identity**.
36
37
- SQL Server can use this primary managed identity in either `inbound` and/or `outbound` connections.
37
-
-`Inbound connections` are logins and users connecting to SQL Server. Inbound connections can also be achieved by using [App Registration available from SQL Server 2022](../../sql-server/azure-arc/entra-authentication-setup-tutorial.md).
38
-
-`Outbound connections` are SQL Server connections to Azure resources, like backup to URL, or connecting to Azure Key Vault.
38
+
-`Inbound connections` are logins and users connecting to SQL Server. Inbound connections can also be achieved by using [App Registration available from SQL Server 2022](entra-authentication-setup-tutorial.md).
39
+
-`Outbound connections` are SQL Server connections to Azure resources, like backup to URL, or connecting to Azure Key Vault.
39
40
- App Registration **can't** enable a SQL Server to make outbound connections. Outbound connections need a primary managed identity assigned to the SQL Server.
40
41
41
42
## Prerequisites
42
43
43
-
To use a managed identity with SQL Server 2025, you need to [connect the SQL Server instance to Azure Arc](connect.md).
44
+
Before you can use a managed identity with SQL Server enabled by Azure Arc, ensure that you meet the following prerequisites:
45
+
46
+
-[Connect the SQL Server instance to Azure Arc](connect.md).
47
+
- The latest version of the [Azure Extension for SQL Server](release-notes.md).
48
+
49
+
## Enable the primary managed identity
50
+
51
+
If you've installed the Azure Extension for SQL Server to your server, you can enable the primary managed identity for your SQL Server instance directly from the Azure portal. It's also possible to enable the primary managed identity manually by updating the registry, but should be done with extreme caution.
52
+
53
+
### [Azure portal](#tab/portal)
54
+
55
+
To enable the primary managed identity in the Azure portal, follow these steps:
44
56
45
-
> [!CAUTION]
46
-
> Microsoft Entra authentication (**Inbound**) in SQL Server 2025 doesn't currently support users who are members of more than 200 Microsoft Entra groups. Such an authentication attempt can result in unpredictable behavior and affect the functionality of your instance.
57
+
1. Go to your [SQL Server enabled by Azure Arc](https://portal.azure.com/#view/Microsoft_Azure_ArcCenterUX/ArcCenterMenuBlade/~/sqlServerInstances) resource in the Azure portal.
58
+
1. Under **Settings**, select **Microsoft Entra ID and Purview** to open the **Microsoft Entra ID and Purview** page.
47
59
48
-
## Grant permission to the Tokens folder
60
+
> [!NOTE]
61
+
> If you don't see the **Enable Microsoft Entra ID authentication** option, ensure that your SQL Server instance is connected to Azure Arc and that you have the latest SQL extension installed.
62
+
63
+
1. On the **Microsoft Entra ID and Purview** page, check the box next to **Use a primary managed identity** and then use **Save** to apply your configuration:
64
+
65
+
:::image type="content" source="media/managed-identity/entra-portal.png" alt-text="Screenshot of the Microsoft Entra option in the Azure portal." lightbox="media/managed-identity/entra-portal.png":::
66
+
67
+
68
+
### [Manually](#tab/manual)
69
+
70
+
It's possible to manually enable the primary managed identity for your SQL Server instance by updating the registry, but should be done with extreme caution.
71
+
72
+
### Grant permission to the Tokens folder
49
73
50
74
Grant **Read & execute** operating system permissions on the folder `C:\ProgramData\AzureConnectedMachineAgent\Tokens\` to the SQL Server 2025 instance service account. By default, the service account is `NT Service\MSSQLSERVER`, or for named instances, `NT Service\MSSQL$<instancename>`.
51
75
@@ -55,7 +79,7 @@ You might need to grant admin permissions for the SQL Server service account on
55
79
56
80
:::image type="content" source="media/managed-identity/azure-connected-machine-agent-folder-permissions.png" alt-text="Screenshot of AzureConnectedMachineAgent folder Security properties tab.":::
57
81
58
-
## Add SQL Server service account to the Hybrid agent extension applications group
82
+
###Add SQL Server service account to the Hybrid agent extension applications group
59
83
60
84
Add the SQL Server service account (default: `NT Service\MSSQLSERVER` or for named instances, `NT Service\MSSQL$instancename`) to the **Hybrid agent extension applications** group.
61
85
@@ -67,7 +91,7 @@ Add the SQL Server service account (default: `NT Service\MSSQLSERVER` or for nam
67
91
68
92
:::image type="content" source="media/managed-identity/hybrid-agent-extension-applications-group-properties.png" alt-text="Screenshot of the hybrid agent extension application group properties.":::
69
93
70
-
## Update the registry
94
+
###Update the registry
71
95
72
96
> [!WARNING]
73
97
> Incorrectly editing the registry can severely damage your system. Before making changes to the registry, we recommend you back up any valued data on the computer.
@@ -84,39 +108,39 @@ Create the following entries:
The following sections describe how to back up and edit the registry with Registry Editor.
112
136
113
-
### Open the Registry Editor
137
+
####Open the Registry Editor
114
138
115
139
1. Press **Windows key + R** to open the Run dialog box.
116
140
1. Type `regedit` and press **Enter**.
117
141
1. If prompted by User Account Control, select **Yes**.
118
142
119
-
### Back up the registry key
143
+
####Back up the registry key
120
144
121
145
This step backs up the registry before you make any changes. You can import this file back into the registry later if your changes cause a problem.
122
146
@@ -127,7 +151,7 @@ This step backs up the registry before you make any changes. You can import this
127
151
1. Ensure **All** is selected in the Export range.
128
152
1. Select **Save**.
129
153
130
-
### Add entries
154
+
####Add entries
131
155
132
156
In this step, you'll add entries to the registry with Registry Editor.
133
157
@@ -143,7 +167,7 @@ In this step, you'll add entries to the registry with Registry Editor.
143
167
144
168
:::image type="content" source="media/managed-identity/federated-authentication-registry-key.png" alt-text="Screenshot of the registry set with correct entries." lightbox="media/managed-identity/federated-authentication-registry-key.png":::
145
169
146
-
### Restore the registry key (if needed)
170
+
####Restore the registry key (if needed)
147
171
148
172
If you need to restore to previous registry settings, follow these steps.
149
173
@@ -155,16 +179,17 @@ If you need to restore to previous registry settings, follow these steps.
155
179
156
180
For details, review [How to add, modify, or delete registry subkeys and values by using a .reg file](https://support.microsoft.com/topic/how-to-add-modify-or-delete-registry-subkeys-and-values-by-using-a-reg-file-9c7f37cf-a5e9-e1cd-c4fa-2a26218a1a23).
157
181
158
-
## Grant application permissions to the identity
182
+
---
183
+
184
+
## Grant application permissions to the identity
159
185
160
186
The system-assigned managed identity, which uses the Arc-enabled machine name, must have the following Microsoft Graph application permissions (app roles): `User.Read.All`, `GroupMember.Read.All`, and `Application.Read.All`.
161
187
162
-
You can use PowerShell to grant required permissions to the managed identity. Alternatively, you can [create a role-assignable group](/entra/identity/role-based-access-control/groups-create-eligible). After the group is created, assign the **Directory readers** role to the group, and add all system-assigned managed identities for your Arc-enabled machines to the group.
188
+
You can use PowerShell to grant required permissions to the managed identity. Alternatively, you can [create a role-assignable group](/entra/identity/role-based-access-control/groups-create-eligible). After the group is created, assign the **Directory readers** role to the group, and add all system-assigned managed identities for your Arc-enabled machines to the group.
163
189
164
190
The following PowerShell script grants the required permissions to the managed identity:
165
191
166
192
```powershell
167
-
168
193
# Update these variables to match your Azure & Arc machine setup
@@ -232,7 +257,7 @@ Follow the steps in the [Microsoft Entra tutorial](../../sql-server/azure-arc/en
232
257
Consider the following limitations when using a managed identity with SQL Server 2025:
233
258
234
259
- Microsoft Entra authentication is only supported with Arc enabled SQL Server 2025 running on Windows Server.
235
-
- Using Microsoft Entra authentication with failover cluster instances is not supported.
260
+
- Using Microsoft Entra authentication with failover cluster instances isn't supported.
236
261
- The identity you choose to authenticate to SQL Server has to have either the **Directory Readers** role in Microsoft Entra ID or the following three Microsoft Graph application permissions (app roles): `User.Read.All`, `GroupMember.Read.All`, and `Application.Read.All`.
237
262
- Once Microsoft Entra authentication is enabled, disabling isn't advisable. Disabling Microsoft Entra authentication forcefully by deleting registry entries can result in unpredictable behavior with SQL Server 2025.
238
263
- Authenticating to SQL Server on Arc machines through Microsoft Entra authentication using the [FIDO2 method](/azure/active-directory/authentication/howto-authentication-passwordless-faqs) isn't currently supported.
@@ -241,4 +266,4 @@ Consider the following limitations when using a managed identity with SQL Server
241
266
242
267
-[Microsoft Entra authentication for SQL Server](../../relational-databases/security/authentication-access/azure-ad-authentication-sql-server-overview.md)
243
268
-[What are managed identities for Azure resources?](/entra/identity/managed-identities-azure-resources/overview)
244
-
-[Enable Microsoft Entra authentication - SQL Server on Azure VMs](/azure/azure-sql/virtual-machines/windows/configure-azure-ad-authentication-for-sql-vm)
269
+
-[Enable Microsoft Entra authentication for SQL Server on Azure VMs](/azure/azure-sql/virtual-machines/windows/configure-azure-ad-authentication-for-sql-vm)
0 commit comments