Blog Post

Azure Database Support Blog
3 MIN READ

AAD Auth Error - Login failed for user '<token-identified principal>'

FonsecaSergio's avatar
FonsecaSergio
Icon for Microsoft rankMicrosoft
May 26, 2020
An error may appear when trying to login to Azure SQL DB using AAD authentication   =================================== Cannot connect to SERVENAME.database.windows.net. =======================...
Updated Aug 11, 2023
Version 4.0
azuresqldb
Connectivity
chad's avatar
chad
Copper Contributor
Feb 08, 2021

You are probably using a guest invite for someone who has access to multiple Azure tenants. If that's the case, they need to specify the tenant ID as well in the SSMS connection options at the bottom.

 

The tenant ID is xxxx.onmicrosoft.com (the tenant containing the SQL DB)

 

This is interestingly not true in the https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-mfa-ssms-overview#azure-ad-domain-name-or-tenant-id-parameter

If you are running SSMS 18.x or later, the AD domain name or tenant ID is no longer needed for guest users because 18.x or later automatically recognizes it.

Funny enough - i login to SQL Managed Instacnes via Guest Accounts via Group Access and I keep getting: 

Login failed for user '<token-identified principal>'. (Microsoft SQL Server, Error: 18456)

 

Only fix i have to switch to Azure Data Studio - works some times OR switch to a VDI - works normally.  My main machine fails often - would  be better to know WHICH creds SSMS attempts to use ... CLI / Powershell / Browser? Need to know where i can go to clear out these creds!