You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-cache-for-redis/cache-azure-active-directory-for-authentication.md
+19-19Lines changed: 19 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
-
title: Use Microsoft Entra ID for cache authentication
2
+
title: Use Microsoft Entra for cache authentication
3
3
titleSuffix: Azure Cache for Redis
4
-
description: Learn how to use Microsoft Entra ID with Azure Cache for Redis.
4
+
description: Learn how to use Microsoft Entra with Azure Cache for Redis.
5
5
author: flang-msft
6
6
7
7
ms.custom: references_regions
@@ -12,13 +12,13 @@ ms.author: franlanglois
12
12
13
13
---
14
14
15
-
# Use Microsoft Entra ID for cache authentication
15
+
# Use Microsoft Entra for cache authentication
16
16
17
-
Azure Cache for Redis offers two methods to [authenticate](cache-configure.md#authentication) to your cache instance: access keys and Microsoft Entra ID.
17
+
Azure Cache for Redis offers two methods to [authenticate](cache-configure.md#authentication) to your cache instance: access keys and Microsoft Entra.
18
18
19
19
Although access key authentication is simple, it comes with a set of challenges around security and password management. For contrast, in this article, you learn how to use a Microsoft Entra token for cache authentication.
20
20
21
-
Azure Cache for Redis offers a password-free authentication mechanism by integrating with [Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-whatis). This integration also includes [role-based access control](/azure/role-based-access-control/) functionality provided through [access control lists (ACLs)](https://redis.io/docs/management/security/acl/) supported in open-source Redis.
21
+
Azure Cache for Redis offers a password-free authentication mechanism by integrating with [Microsoft Entra](/azure/active-directory/fundamentals/active-directory-whatis). This integration also includes [role-based access control](/azure/role-based-access-control/) functionality provided through [access control lists (ACLs)](https://redis.io/docs/management/security/acl/) supported in open-source Redis.
22
22
23
23
To use the ACL integration, your client application must assume the identity of a Microsoft Entra entity, like service principal or managed identity, and connect to your cache. In this article, you learn how to use your service principal or managed identity to connect to your cache. You also learn how to grant your connection predefined permissions based on the Microsoft Entra artifact that's used for the connection.
24
24
@@ -30,15 +30,15 @@ To use the ACL integration, your client application must assume the identity of
30
30
31
31
## Prerequisites and limitations
32
32
33
-
- Microsoft Entra ID-based authentication is supported for SSL connections and TLS 1.2 or higher.
34
-
- Microsoft Entra ID-based authentication isn't supported on Azure Cache for Redis instances that [depend on Azure Cloud Services](./cache-faq.yml#caches-with-a-dependency-on-cloud-services--classic).
35
-
- Microsoft Entra ID-based authentication isn't supported in the Enterprise tiers of Azure Cache for Redis Enterprise.
33
+
- Microsoft Entra authentication is supported for SSL connections and TLS 1.2 or higher.
34
+
- Microsoft Entra authentication isn't supported on Azure Cache for Redis instances that [depend on Azure Cloud Services](./cache-faq.yml#caches-with-a-dependency-on-cloud-services--classic).
35
+
- Microsoft Entra authentication isn't supported in the Enterprise tiers of Azure Cache for Redis Enterprise.
36
36
- Some Redis commands are blocked. For a full list of blocked commands, see [Redis commands not supported in Azure Cache for Redis](cache-configure.md#redis-commands-not-supported-in-azure-cache-for-redis).
37
37
38
38
> [!IMPORTANT]
39
-
> After a connection is established by using a Microsoft Entra token, client applications must periodically refresh the Microsoft Entra token before expiry. Then the apps must send an `AUTH` command to the Redis server to avoid disrupting connections. For more information, see [Configure your Redis client to use Microsoft Entra ID](#configure-your-redis-client-to-use-microsoft-entra-id).
39
+
> After a connection is established by using a Microsoft Entra token, client applications must periodically refresh the Microsoft Entra token before expiry. Then the apps must send an `AUTH` command to the Redis server to avoid disrupting connections. For more information, see [Configure your Redis client to use Microsoft Entra](#configure-your-redis-client-to-use-microsoft-entra-id).
40
40
41
-
## Enable Microsoft Entra ID authentication on your cache
41
+
## Enable Microsoft Entra authentication on your cache
42
42
43
43
1. In the Azure portal, select the Azure Cache for Redis instance where you want to configure Microsoft Entra token-based authentication.
44
44
@@ -55,17 +55,17 @@ To use the ACL integration, your client application must assume the identity of
55
55
> [!IMPORTANT]
56
56
> After the enable operation is finished, the nodes in your cache instance reboot to load the new configuration. We recommend that you perform this operation during your maintenance window or outside your peak business hours. The operation can take up to 30 minutes.
57
57
58
-
For information on how to use Microsoft Entra ID with the Azure CLI, see the [reference pages for identity](/cli/azure/redis/identity).
58
+
For information on how to use Microsoft Entra with the Azure CLI, see the [reference pages for identity](/cli/azure/redis/identity).
59
59
60
60
## Disable access key authentication on your cache
61
61
62
-
Using Microsoft Entra ID is the secure way to connect your cache. We recommend that you use Microsoft Entra ID and disable access keys.
62
+
Using Microsoft Entra is the secure way to connect your cache. We recommend that you use Microsoft Entra and disable access keys.
63
63
64
-
When you disable access key authentication for a cache, all existing client connections are terminated, whether they use access keys or Microsoft Entra ID authentication. Follow the recommended Redis client best practices to implement proper retry mechanisms for reconnecting Microsoft Entra-based connections, if any.
64
+
When you disable access key authentication for a cache, all existing client connections are terminated, whether they use access keys or Microsoft Entra authentication. Follow the recommended Redis client best practices to implement proper retry mechanisms for reconnecting Microsoft Entra-based connections, if any.
65
65
66
66
Before you disable access keys:
67
67
68
-
- Microsoft Entra ID authorization must be enabled.
68
+
- Microsoft Entra authorization must be enabled.
69
69
- Disabling access keys is only available for Basic, Standard, and Premium tier caches.
70
70
- For geo-replicated caches, you must:
71
71
@@ -88,7 +88,7 @@ If you have a cache where access keys are used and you want to disable access ke
88
88
1. Confirm that you want to update your configuration by selecting **Yes**.
89
89
90
90
> [!IMPORTANT]
91
-
> When the **Disable Access Keys Authentication** setting is changed for a cache, all existing client connections, using access keys or Microsoft Entra ID, are terminated. Follow the best practices to implement proper retry mechanisms for reconnecting Microsoft Entra-based connections. For more information, see [Connection resilience](cache-best-practices-connection.md).
91
+
> When the **Disable Access Keys Authentication** setting is changed for a cache, all existing client connections, using access keys or Microsoft Entra, are terminated. Follow the best practices to implement proper retry mechanisms for reconnecting Microsoft Entra-based connections. For more information, see [Connection resilience](cache-best-practices-connection.md).
92
92
93
93
## Use data access configuration with your cache
94
94
@@ -115,9 +115,9 @@ If you want to use a custom access policy instead of Redis Data Owner, go to **D
115
115
> [!IMPORTANT]
116
116
> After the enable operation is finished, the nodes in your cache instance reboot to load the new configuration. We recommend that you perform this operation during your maintenance window or outside your peak business hours. The operation can take up to 30 minutes.
117
117
118
-
## Configure your Redis client to use Microsoft Entra ID
118
+
## Configure your Redis client to use Microsoft Entra
119
119
120
-
Because most Azure Cache for Redis clients assume that a password and access key are used for authentication, you likely need to update your client workflow to support authentication by using Microsoft Entra ID. In this section, you learn how to configure your client applications to connect to Azure Cache for Redis by using a Microsoft Entra token.
120
+
Because most Azure Cache for Redis clients assume that a password and access key are used for authentication, you likely need to update your client workflow to support authentication by using Microsoft Entra. In this section, you learn how to configure your client applications to connect to Azure Cache for Redis by using a Microsoft Entra token.
121
121
122
122
### Microsoft Entra client workflow
123
123
@@ -135,9 +135,9 @@ Because most Azure Cache for Redis clients assume that a password and access key
135
135
136
136
### Client library support
137
137
138
-
The library [`Microsoft.Azure.StackExchangeRedis`](https://www.nuget.org/packages/Microsoft.Azure.StackExchangeRedis) is an extension of `StackExchange.Redis` that enables you to use Microsoft Entra ID to authenticate connections from a Redis client application to an Azure Cache for Redis. The extension manages the authentication token, including proactively refreshing tokens before they expire to maintain persistent Redis connections over multiple days.
138
+
The library [`Microsoft.Azure.StackExchangeRedis`](https://www.nuget.org/packages/Microsoft.Azure.StackExchangeRedis) is an extension of `StackExchange.Redis` that enables you to use Microsoft Entra to authenticate connections from a Redis client application to an Azure Cache for Redis. The extension manages the authentication token, including proactively refreshing tokens before they expire to maintain persistent Redis connections over multiple days.
139
139
140
-
[This code sample](https://github.com/Azure/Microsoft.Azure.StackExchangeRedis) demonstrates how to use the `Microsoft.Azure.StackExchangeRedis` NuGet package to connect to your Azure Cache for Redis instance by using Microsoft Entra ID.
140
+
[This code sample](https://github.com/Azure/Microsoft.Azure.StackExchangeRedis) demonstrates how to use the `Microsoft.Azure.StackExchangeRedis` NuGet package to connect to your Azure Cache for Redis instance by using Microsoft Entra.
141
141
142
142
The following table includes links to code samples. They demonstrate how to connect to your Azure Cache for Redis instance by using a Microsoft Entra token. Various client libraries are included in multiple languages.
0 commit comments