Azure SQL Managed Instance announces limited public preview for Windows Authentication protocol for Azure Active Directory users, and support for Managed Identity credential across Managed Instance surface area.
No one loves passwords. They are the most common attack target and require extra caution and maintenance to use them in a secure way. To address this, Microsoft is making continued investments in Azure Active Directory (Azure AD) authentication and Managed identities to pave the way to a passwordless future.
Within the Azure SQL team, we are building on top of those investments, and with our latest improvements that future is about to begin for users of Managed Instance.
You can disable password-based access (SQL Authentication) to your Managed Instance even today by using the Azure AD-only authentication setting. But what if you have an app that doesn’t support Azure AD authentication, or what if you are still using Windows Authentication? For you, we bring Windows Authentication to Azure AD.
Windows Authentication protocol for Azure AD users
Windows Authentication is an additional Single-Sign-On authentication option for Azure AD users that supports Azure AD authentication with the Kerberos protocol. From a compatibility perspective it enables legacy apps or just apps that do not yet support Azure AD authentication to connect to Managed Instance. In that regard, your existing portfolio of applications, no matter how old, will no longer represent a barrier for identity management and security modernization in Azure.
Yet this feature is not only about compatibility, but also about hardening the security and modernizing the infrastructure. If your application is running on Windows 11 Azure AD joined or Hybrid Azure AD joined machine that you’ve logged into with modern authentication (i.e., Windows Hello), that would count as Multi Factor Authentication (MFA) and you’ll be granted secure access to your Managed Instance.
Though I’m sure you’d agree this is great, you may wonder what exactly it was that we’ve done to enable passwordless connection between Managed Instance and other Azure resources.
Configuring Managed Instance secure access to the Azure resources
Managed identity has been used for some time to provide Managed Instance with secure, passwordless, and RBAC-based, access to Azure AD to support authentication, and access to Azure Key Vault for TDE customer managed key. Now we are expanding these to a new set of scenarios.
Once you create a server or database level credential with Managed Identity, you will be able to use this credential to authenticate to an Azure Storage account while doing backup / restore, bulk loading of data, and creating a server audit.
CREATE CREDENTIAL [https://mitutorials.blob.core.windows.net/backups]
WITH IDENTITY = 'Managed Identity'
RESTORE FILELISTONLY FROM URL =
'https://mitutorials.blob.core.windows.net/backups/WideWorldImporters-Standard.bak'
And this is not all. In this wave of improvements, we’ve added Managed identity support to a linked server feature, effectively extending passwordless access to any Azure SQL resource with Azure AD authentication enabled.
EXEC master.dbo.sp_addlinkedserver
=N'MyLinkedServerMSI',
=N'MSOLEDBSQL',
@provstr=N'Server=lsdemomi.a3c42d4b14e.database.windows.net;Authentication=ActiveDirectoryMSI'
EXEC master.dbo.sp_addlinkedsrvlogin
@rmtsrvname=N'MyLinkedServerMSI',@useself=N'False'
If the linked server is a Managed Instance in the same Server Trust Group, then you could configure this linked server in such a way that the authentication context flows from the primary instance to the linked instance.
EXEC master.dbo.sp_addlinkedserver
=N'MyLinkedServer',
=N'MSOLEDBSQL',
@datasrc=N'lsdemomi.a3c42d4b14e.database.windows.net'
EXEC master.dbo.sp_addlinkedsrvlogin
@rmtsrvname=N'MyLinkedServer',
@useself=N'True'
Next steps
You can start improving the security of your Managed Instance today:
- Switch your Managed Instance to Azure AD-only authentication
- Swap SAS token credentials with Managed Identity credentials
- Apply for Windows Authentication protocol for Azure AD users limited public preview
Going forward
Improvements don’t stop here. In the near term we plan to support user-assigned managed identity as a primary managed identity for Managed Instance, as well to enable the use of Managed Identity for passwordless authentication in transactional replication and log replay service.
Keep an eye on the AzureSQL TechCommunity Blog to learn more on these topics.