/identity-managed-identity

Azure SQL with Managed Identity

Azure SQL application access is not completed by Azure RBAC alone. The workload identity must authenticate with Microsoft Entra ID and also exist as a contained database user in each target database with the required database roles or grants.

Required design decisions

1. Configure Microsoft Entra authentication for the logical server or managed instance.
2. Decide whether the app uses system-assigned or user-assigned managed identity.
3. Create a contained database user for the identity in every target database.
4. Grant the smallest database permissions required.
5. Use a managed identity connection mode in the application.

Contained database user

Run this while connected as a Microsoft Entra principal that can create users in the database.

CREATE USER [<managed-identity-name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<managed-identity-name>];
ALTER ROLE db_datawriter ADD MEMBER [<managed-identity-name>];

Use only the roles required. For read-only workloads, do not grant db_datawriter. Prefer explicit grants for tightly scoped production databases:

CREATE USER [<managed-identity-name>] FROM EXTERNAL PROVIDER;
GRANT SELECT ON SCHEMA::[reporting] TO [<managed-identity-name>];

Connection strings

System-assigned managed identity

Server=tcp:<server>.database.windows.net,1433;Database=<database>;Authentication=Active Directory Managed Identity;Encrypt=True;

User-assigned managed identity

For Microsoft.Data.SqlClient versions that support user-assigned managed identity client ID in the connection string:

Server=tcp:<server>.database.windows.net,1433;Database=<database>;Authentication=Active Directory Managed Identity;User Id=<managed-identity-client-id>;Encrypt=True;

Alternative: acquire a token with ManagedIdentityCredential and pass it to the SQL client using supported token APIs.

Note: Starting with Microsoft.Data.SqlClient 7.0, the Microsoft Entra authentication dependencies were removed from the core package, so Entra auth modes (including Active Directory Managed Identity) now require the separate NuGet package Microsoft.Data.SqlClient.Extensions.Azure. Upgrading a project to 7.0 without adding this package silently breaks Entra authentication. (Verified 2026-06-16.)

Common failures

Do not

• Use SQL authentication username/password for new application code.
• Assume Azure SQL DB Contributor gives query access to application data.
• Use a shared migration identity as the runtime identity.
• Grant db_owner unless the application administers the database.