Qtip: Connect Windows Azure VM to Azure SQL DB using Managed Identity

[jaigarcimicrosoft]

In this guide I am going to show steps to connect Windows Azure VM to Azure SQL DB using Managed Identity covering create user in Azure SQL DB , connect using SSMS and connect using powershell



Requirements:

Windows 10 or 11 Azure Virtual Machine with system managed identity enabled and admin privileges to run powershell scripts
Azure SQL DB server with entra admin access and database for testing
SQL Server Management Studio (SSMS) latest version



Get required information from VM and managed identity:



Use Object (principal) ID to get Application ID

Go to Entra ID and search Object (principal) ID



Select result to get Application ID





Provide access to Azure SQL DB:

Connect to server/database using Entra user with admin privileges and create user in this case is the name of the computer



-- DROP USER [managediddemo] --remove user if exists
CREATE USER [managediddemo] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [managediddemo];



Connect from Azure VM:

Connect using SQL Server Management Studio SSMS ...

Open SSMS and provide server name , select authentication Microsoft Entra Managed Identity and user assigned Identity will be Application ID from VM



In connection properties provide database name otherwise you will receive an error if user is not administrator and finally connect





Now is connected



Connect using powershell...



To be able to connect using powershell you need to Install modules required for Azure

Open powershell as administrator and run commands below

Set-ExecutionPolicy unrestricted
Install-Module -Name PowerShellGet -Force
Install-Module -Name Az -AllowClobber -Scope CurrentUser -force
Install-module SQLServer -force



Once modules are installed you can close powershell and open again as administrator



Get token

Connect-AzAccount -Identity
$access_token = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token
write-host $access_token



*In some scenarios token string can be provided directly to avoid round trip each time



Test with invoke-sqlcmd

Connect-AzAccount -Identity
$access_token = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token
Invoke-Sqlcmd -ServerInstance <servername>.database.windows.net -Database <dbname> -AccessToken $access_token -query 'select top 10 name from sys.tables'

-query is the query to run in this case only gets a list of tables in database





Test using Microsoft.Data.SQLClient

import-module Az.Accounts
import-module Microsoft.PowerShell.Security
import-module Microsoft.WSMan.Management
import-module SqlServer
$access_token = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token
$connectionstring="Server=tcp:<servername>.database.windows.net,1433; Database=<dbname>; Encrypt=True;"
$connection= New-Object Microsoft.Data.SqlClient.SqlConnection
# you can get connection string from azure portal in database overview
$connection.ConnectionString = $connectionstring
$connection.AccessToken=$access_token
$connection.Open()
$command= $connection.CreateCommand()
$command.CommandText = "select top 10 name from sys.tables"
$dataSet = New-Object system.Data.DataSet
$adapter = New-Object microsoft.Data.SqlClient.SqlDataAdapter $command
$adapter.Fill($dataSet) | Out-Null
$connectionid=$connection.clientconnectionid
write-output $connectionid
$dataSet.Tables



Now your Windows Azure VM is able to connect using different methods



More Information

Provision Azure AD admin (SQL Database)
Configure Microsoft Entra authentication - Azure SQL Database & SQL Managed Instance & Azure Synapse Analytics



What are managed identities for Azure resources?

Managed identities for Azure resources - Managed identities for Azure resources



Configure managed identities on Azure virtual machines (VMs)

Configure managed identities on Azure virtual machines (VMs) - Managed identities for Azure resources

Continue reading...