SOLVED

Create login from Entra ID Security Group rather than individual

Copper Contributor

This article says I can create a Login in Azure SQL Server from a Microsoft EntraID Security Group. I can, and it works, and it appears in sys.server_principals as type_desc 'EXTERNAL_GROUP' and type 'X'. (I note that non-group EntraID logins appear as type_desc 'EXTERNAL_LOGIN' and type 'E'.)

But when I try the next step in the article, which is to create a User from the Login, I get the error '<EntraIDGroupName> is not a valid login or you do not have permission'.

I have successfully created Users from non-group Logins, so I don't think it's a permission problem.

Is it the case that, despite the article, you can't actually create a group user this way - I have to create individual logins and users for each potential EntraID user I want to have access the database? Or am I missing a trick somewhere?

2 Replies
best response confirmed by JonathanGibbs (Copper Contributor)
Solution

@JonathanGibbs You can create a login in Azure SQL Server from a Microsoft EntraID Security Group.

 

However, creating a user from the login might not be possible.
You might get an error message <EntraIDGroupName> is not a valid login or you do not have permission’. This error message is because the login is a group login, not an individual one.

 

You can try creating individual logins and users for each potential EntraID user you want access to the database.

 

You can read more at Microsoft Learn.

https://learn.microsoft.com/en-us/entra/architecture/4-secure-access-groups

https://learn.microsoft.com/en-us/entra/fundamentals/concept-learn-about-groups

 

Let me know if this works for you. @ me in replies, or I'll lose your thread!!!  
Note:
If this post is helpful, please mark it as the solution to help others find it easily. Also, if my answers contribute to a solution, show your appreciation by giving it a thumbs up

Thanks @BabatundeDallas - that's what I have ended up doing

1 best response

Accepted Solutions
best response confirmed by JonathanGibbs (Copper Contributor)
Solution

@JonathanGibbs You can create a login in Azure SQL Server from a Microsoft EntraID Security Group.

 

However, creating a user from the login might not be possible.
You might get an error message <EntraIDGroupName> is not a valid login or you do not have permission’. This error message is because the login is a group login, not an individual one.

 

You can try creating individual logins and users for each potential EntraID user you want access to the database.

 

You can read more at Microsoft Learn.

https://learn.microsoft.com/en-us/entra/architecture/4-secure-access-groups

https://learn.microsoft.com/en-us/entra/fundamentals/concept-learn-about-groups

 

Let me know if this works for you. @ me in replies, or I'll lose your thread!!!  
Note:
If this post is helpful, please mark it as the solution to help others find it easily. Also, if my answers contribute to a solution, show your appreciation by giving it a thumbs up

View solution in original post