|
| 1 | +--- |
| 2 | +title: Configure multi-factor authentication |
| 3 | +titleSuffix: Azure SQL Database & SQL Managed Instance & Azure Synapse Analytics |
| 4 | +description: Learn how to use Multi-Factored Authentication with SSMS for Azure SQL Database, Azure SQL Managed Instance and Azure Synapse Analytics. |
| 5 | +services: sql-database |
| 6 | +ms.service: sql-database |
| 7 | +ms.subservice: security |
| 8 | +ms.custom: has-adal-ref, sqldbrb=3 |
| 9 | +ms.devlang: |
| 10 | +ms.topic: conceptual |
| 11 | +author: GithubMirek |
| 12 | +ms.author: mireks |
| 13 | +ms.reviewer: vanto |
| 14 | +ms.date: 08/27/2019 |
| 15 | +--- |
| 16 | +# Configure multi-factor authentication for SQL Server Management Studio and Azure AD |
| 17 | +[!INCLUDE[appliesto-sqldb-sqlmi-asa](includes/appliesto-sqldb-sqlmi-asa.md)] |
| 18 | + |
| 19 | +This article shows you how to use Azure Active Directory multi-factor authentication (MFA) with SQL Server Management Studio. Azure AD MFA can be used when connecting SSMS or SqlPackage.exe to [Azure SQL Database](database/sql-database-paas-overview.md), [Azure SQL Managed Instance](managed-instance/sql-managed-instance-paas-overview.md) and [Azure Synapse Analytics (formerly SQL DW)](../synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is.md). For an overview of multi-factor authentication, see [Universal Authentication with SQL Database, SQL Managed Instance, and Azure Synapse (SSMS support for MFA)](../database/authentication-mfa-ssms-overview.md). |
| 20 | + |
| 21 | +> [!IMPORTANT] |
| 22 | +> Databases in Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse (formerly Azure SQL Data Warehouse) are referred to collectively in the remainder of this article as databases, and the server is referring to the [server](database/logical-servers.md) that hosts databases for Azure SQL Database and Azure Synapse. |
| 23 | +
|
| 24 | +## Configuration steps |
| 25 | + |
| 26 | +1. **Configure an Azure Active Directory** - For more information, see [Administering your Azure AD directory](https://msdn.microsoft.com/library/azure/hh967611.aspx), [Integrating your on-premises identities with Azure Active Directory](../active-directory/hybrid/whatis-hybrid-identity.md), [Add your own domain name to Azure AD](https://azure.microsoft.com/blog/20../../windows-azure-now-supports-federation-with-windows-server-active-directory/), [Microsoft Azure now supports federation with Windows Server Active Directory](https://azure.microsoft.com/blog/20../../windows-azure-now-supports-federation-with-windows-server-active-directory/), and [Manage Azure AD using Windows PowerShell](https://msdn.microsoft.com/library/azure/jj151815.aspx). |
| 27 | +2. **Configure MFA** - For step-by-step instructions, see [What is Azure Multi-Factor Authentication?](../active-directory/authentication/multi-factor-authentication.md), [Conditional Access (MFA) with Azure SQL Database and Data Warehouse](database/conditional-access-configure.md). (Full Conditional Access requires a Premium Azure Active Directory (Azure AD). Limited MFA is available with a standard Azure AD.) |
| 28 | +3. **Configure Azure AD Authentication** - For step-by-step instructions, see [Connecting to SQL Database, SQL Managed Instance, or Azure Synapse using Azure Active Directory Authentication](database/aad-authentication-overview.md). |
| 29 | +4. **Download SSMS** - On the client computer, download the latest SSMS, from [Download SQL Server Management Studio (SSMS)](https://msdn.microsoft.com/library/mt238290.aspx). |
| 30 | + |
| 31 | +## Connecting by using universal authentication with SSMS |
| 32 | + |
| 33 | +The following steps show how to connect using the latest SSMS. |
| 34 | + |
| 35 | +1. To connect using Universal Authentication, on the **Connect to Server** dialog box in SQL Server Management Studio (SSMS), select **Active Directory - Universal with MFA support**. (If you see **Active Directory Universal Authentication** you are not on the latest version of SSMS.) |
| 36 | + ![1mfa-universal-connect][1] |
| 37 | +2. Complete the **User name ** box with the Azure Active Directory credentials, in the format `[email protected]`. |
| 38 | +  |
| 39 | +3. If you are connecting as a guest user, you no longer need to complete the AD domain name or tenant ID field for guest users because SSMS 18.x or later automatically recognizes it. For more information, see [Universal Authentication with SQL Database, SQL Managed Instance, and Azure Synapse (SSMS support for MFA)](../database/authentication-mfa-ssms-overview.md). |
| 40 | +  |
| 41 | + |
| 42 | + However, If you are connecting as a guest user using SSMS 17.x or older, you must click **Options**, and on the **Connection Property** dialog box, and complete the **AD domain name or tenant ID** box. |
| 43 | +  |
| 44 | + |
| 45 | +4. Select **Options ** and specify the database on the **Options ** dialog box. (If the connected user is a guest user ( i.e. [email protected]), you must check the box and add the current AD domain name or tenant ID as part of Options. See [Universal Authentication with SQL Database and SQL Data Warehouse (SSMS support for MFA) ](../database/authentication-mfa-ssms-overview.md). Then click **Connect **. |
| 46 | +5. When the **Sign in to your account** dialog box appears, provide the account and password of your Azure Active Directory identity. No password is required if a user is part of a domain federated with Azure AD. |
| 47 | + ![2mfa-sign-in][2] |
| 48 | + |
| 49 | + > [!NOTE] |
| 50 | + > For Universal Authentication with an account that does not require MFA, you connect at this point. For users requiring MFA, continue with the following steps: |
| 51 | + > |
| 52 | +
|
| 53 | +6. Two MFA setup dialog boxes might appear. This one time operation depends on the MFA administrator setting, and therefore may be optional. For an MFA enabled domain this step is sometimes pre-defined (for example, the domain requires users to use a smartcard and pin). |
| 54 | + ![3mfa-setup][3] |
| 55 | +7. The second possible one time dialog box allows you to select the details of your authentication method. The possible options are configured by your administrator. |
| 56 | + ![4mfa-verify-1][4] |
| 57 | +8. The Azure Active Directory sends the confirming information to you. When you receive the verification code, enter it into the **Enter verification code** box, and click **Sign in**. |
| 58 | + ![5mfa-verify-2][5] |
| 59 | + |
| 60 | +When verification is complete, SSMS connects normally presuming valid credentials and firewall access. |
| 61 | + |
| 62 | +## Next steps |
| 63 | + |
| 64 | +- For an overview of multi-factor authentication, see [Universal Authentication with SQL Database, SQL Managed Instance, and Azure Synapse (SSMS support for MFA)](../database/authentication-mfa-ssms-overview.md). |
| 65 | +- Grant others access to your database: [SQL Database Authentication and Authorization: Granting Access](database/logins-create-manage.md) |
| 66 | +- Make sure others can connect through the firewall: [Configure a server-level firewall rule using the Azure portal](/database/firewall-configure.md) |
| 67 | +- When using **Active Directory- Universal with MFA** authentication, ADAL tracing is available beginning with [SSMS 17.3](https://docs.microsoft.com/sql/ssms/download-sql-server-management-studio-ssms). Off by default, you can turn on ADAL tracing by using the **Tools**, **Options** menu, under **Azure Services**, **Azure Cloud**, **ADAL Output Window Trace Level**, followed by enabling **Output** in the **View** menu. The traces are available in the output window when selecting **Azure Active Directory option**. |
0 commit comments