Qtip: Connect Windows Azure VM to Azure SQL DB using Managed Identity
In this guide I am going to show steps to connect Windows Azure VM to Azure SQL DB using Managed Identity covering create user in Azure SQL DB , connect using SSMS and connect using powershell
Requirements:
Windows 10 or 11 Azure Virtual Machine with system managed identity enabled and admin privileges to run powershell scripts
Azure SQL DB server with entra admin access and database for testing
SQL Server Management Studio (SSMS) latest version
Get required information from VM and managed identity:
Use Object (principal) ID to get Application ID
Go to Entra ID and search Object (principal) ID
Select result to get Application ID
Provide access to Azure SQL DB:
Connect to server/database using Entra user with admin privileges and create user in this case is the name of the computer
— DROP USER [managediddemo] –remove user if exists
CREATE USER [managediddemo] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [managediddemo];
Connect from Azure VM:
Connect using SQL Server Management Studio SSMS …
Open SSMS and provide server name , select authentication Microsoft Entra Managed Identity and user assigned Identity will be Application ID from VM
In connection properties provide database name otherwise you will receive an error if user is not administrator and finally connect
Now is connected
Connect using powershell…
To be able to connect using powershell you need to Install modules required for Azure
Open powershell as administrator and run commands below
Set-ExecutionPolicy unrestricted
Install-Module -Name PowerShellGet -Force
Install-Module -Name Az -AllowClobber -Scope CurrentUser -force
Install-module SQLServer -force
Once modules are installed you can close powershell and open again as administrator
Get token
Connect-AzAccount -Identity
$access_token = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token
write-host $access_token
*In some scenarios token string can be provided directly to avoid round trip each time
Test with invoke-sqlcmd
Connect-AzAccount -Identity
$access_token = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token
Invoke-Sqlcmd -ServerInstance <servername>.database.windows.net -Database <dbname> -AccessToken $access_token -query ‘select top 10 name from sys.tables’
-query is the query to run in this case only gets a list of tables in database
Test using Microsoft.Data.SQLClient
import-module Az.Accounts
import-module Microsoft.PowerShell.Security
import-module Microsoft.WSMan.Management
import-module SqlServer
$access_token = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token
$connectionstring=”Server=tcp:<servername>.database.windows.net,1433; Database=<dbname>; Encrypt=True;”
$connection= New-Object Microsoft.Data.SqlClient.SqlConnection
# you can get connection string from azure portal in database overview
$connection.ConnectionString = $connectionstring
$connection.AccessToken=$access_token
$connection.Open()
$command= $connection.CreateCommand()
$command.CommandText = “select top 10 name from sys.tables”
$dataSet = New-Object system.Data.DataSet
$adapter = New-Object microsoft.Data.SqlClient.SqlDataAdapter $command
$adapter.Fill($dataSet) | Out-Null
$connectionid=$connection.clientconnectionid
write-output $connectionid
$dataSet.Tables
Now your Windows Azure VM is able to connect using different methods
More Information
Provision Azure AD admin (SQL Database)
https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell#provision-azure-ad-admin-sql-database
What are managed identities for Azure resources?
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
Configure managed identities on Azure virtual machines (VMs)
Microsoft Tech Community – Latest Blogs –Read More
