How do I integrate Microsoft Entra ID users with SQL server on SQLVM

Question

How do I integrate Microsoft Entra ID users with SQL server on SQLVM

TAMWO Arnaud 0

Hello all,

I am having an issue with remotely using my business software installed on my SQLVM. I have set up the remote access to the software on my SQLVM using AVD web client. The remote access using an Entra ID test user is successfully however, once I am on the business software interface I cannot login to the SQL database as I get the error message below :

image (1)

As you can see, I opened a Desktop session (using AVD web client) on my VM to access the SAGE 100 business software but when I try to login, I get the error message because the Entra ID user is not communicating with the SQL database.

How do I resolve this?

I have tried the guideline suggested on the link below, but I am stuck at the database user permissions configurations :

https://dori-uw-1.kuma-moon.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-portal

Your help is much appreciated as this is an urgent case.

Best regards

Anonymous

2025-12-18T15:14:10.8666667+00:00
Hey TAMWO Arnaud!

It sounds like you're trying to work with Microsoft Entra ID users for logging into your SQL Server running on an Azure VM, and you're facing issues with user permissions.

Can you try the Troubleshooting Steps:

Check Managed Identity Permissions: Make sure that the managed identity associated with your SQL Server VM has the necessary permissions in Microsoft Entra. It should have at least the following three permissions:

User.Read.All

GroupMember.Read.All

Application.Read.All

Alternatively, you can assign the managed identity to the Directory Readers role.

Add Managed Identity to Directory Readers Role:

Navigate to Microsoft Entra ID Roles and Administrators in the Azure portal.

Search for Directory Readers and select it.

Click on Add assignments to assign your managed identity.

Here’s a reference on how to add the managed identity to the Directory Readers role: Grant Permissions.

Create Logins for Entra ID Users: After ensuring the permissions, you’ll need to create logins for Entra ID users in SQL Server. Use the following T-SQL command:
CREATE LOGIN [user@example.com] FROM EXTERNAL PROVIDER;
Replace [user@example.com] with the actual Entra ID email address.

Assign Roles and Permissions to Users: After creating the login, you may need to assign roles as appropriate using:
EXEC sp_addrolemember 'role_name', 'user@example.com';
Ensure that the roles you assign allow the necessary access to your database.

Review Firewall and NSG Settings: Ensure that your Azure VNet Network Security Group (NSG) allows outbound traffic to Azure Active Directory. Specifically, it should permit traffic on ports 80 and 443.

Resources for Further Guidance:

Enable Microsoft Entra Authentication for SQL Server on Azure VMs

Configure Permissions and Logins

Create and Manage Microsoft Entra Users

Thanks!

Kalyani

2 answers

Your answer

Anonymous

2025-12-18T15:14:10.8666667+00:00

Hey TAMWO Arnaud!

It sounds like you're trying to work with Microsoft Entra ID users for logging into your SQL Server running on an Azure VM, and you're facing issues with user permissions.

Can you try the Troubleshooting Steps:

Check Managed Identity Permissions: Make sure that the managed identity associated with your SQL Server VM has the necessary permissions in Microsoft Entra. It should have at least the following three permissions:

User.Read.All

GroupMember.Read.All

Application.Read.All

Alternatively, you can assign the managed identity to the Directory Readers role.

Add Managed Identity to Directory Readers Role:

Navigate to Microsoft Entra ID Roles and Administrators in the Azure portal.

Search for Directory Readers and select it.

Click on Add assignments to assign your managed identity.

Here’s a reference on how to add the managed identity to the Directory Readers role: Grant Permissions.

Create Logins for Entra ID Users: After ensuring the permissions, you’ll need to create logins for Entra ID users in SQL Server. Use the following T-SQL command:
CREATE LOGIN [user@example.com] FROM EXTERNAL PROVIDER;
Replace [user@example.com] with the actual Entra ID email address.

Assign Roles and Permissions to Users: After creating the login, you may need to assign roles as appropriate using:
EXEC sp_addrolemember 'role_name', 'user@example.com';
Ensure that the roles you assign allow the necessary access to your database.

Review Firewall and NSG Settings: Ensure that your Azure VNet Network Security Group (NSG) allows outbound traffic to Azure Active Directory. Specifically, it should permit traffic on ports 80 and 443.

Resources for Further Guidance:

Enable Microsoft Entra Authentication for SQL Server on Azure VMs

Configure Permissions and Logins

Create and Manage Microsoft Entra Users

Thanks!

Kalyani

Answer 1

TAMWO Arnaud 0

Hello Kalyani,

I was on annual leave so I missed your 2 last posts. Ok I will try again to do what you are suggesting and let you know.

Thanks again.

TAMWO Arnaud 0 Reputation points

2026-01-13T11:32:44.82+00:00

Hello,

I am trying to create a login for the entra ID user but I get this error message :

How do I solve this?

Answer 2

TAMWO Arnaud 0

Hello Kalyani,

thanks for your inputs. I wonder how to check the permissions for the managed identity. Here is a screenshot of the SQL server instance with an Entra ID admin set up :

User's image

Also, that entra ID user is already assigned a Directory reader role as you can see here :

User's image

Before moving to the SQL queries part, is there anything wrong with the above configurations ?

Thanks in advance.

Anonymous

2025-12-19T14:51:31.32+00:00
Hi TAMWO Arnaud,

Thank you for sharing the configuration details.

The Entra ID admin is correctly set on the SQL Server instance. This is required for any Entra ID principal (users or managed identities) to authenticate.

The Directory Reader role assignment is valid, but please note that this role only grants read access to directory objects in Entra ID. It does not provide any database permissions inside SQL Server.

To enable the managed identity to run queries, an additional step is required:

Connect as the Entra ID admin and explicitly create a contained database user for the managed identity with:

CREATE USER [] FROM EXTERNAL PROVIDER;

Then assign the appropriate database roles (for example, db_datareader, db_datawriter, or custom roles) depending on the level of access needed.

Thanks!

Kalyani
Anonymous

2025-12-22T11:29:57.9766667+00:00

we haven't received a response from you regarding the last update. If you've found a resolution, we’d greatly appreciate it if you could share it with the community, as it might benefit others. If not, please let us know, and we’ll provide further details and do our best to assist you.

Share via

How do I integrate Microsoft Entra ID users with SQL server on SQLVM

2 answers

Your answer