You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/managed-identities-azure-resources/tutorial-vm-windows-access-storage.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ This tutorial shows you how to use a system-assigned managed identity for a Wind
30
30
> * Get an access and use it to call Azure Storage
31
31
32
32
> [!NOTE]
33
-
> Azure Active Directory authentication for Azure Storage is in public preview.
33
+
> Microsoft Entra authentication for Azure Storage is in public preview.
34
34
35
35
## Prerequisites
36
36
@@ -96,7 +96,7 @@ This section shows how to grant your VM access to an Azure Storage container. Yo
96
96
97
97
## Access data
98
98
99
-
Azure Storage natively supports Azure AD authentication, so it can directly accept access tokens obtained using a managed identity. This approach uses Azure Storage's integration with Azure AD, and is different from supplying credentials on the connection string.
99
+
Azure Storage natively supports Microsoft Entra authentication, so it can directly accept access tokens obtained using a managed identity. This approach uses Azure Storage's integration with Microsoft Entra ID, and is different from supplying credentials on the connection string.
100
100
101
101
Here's a .NET code example of opening a connection to Azure Storage. The example uses an access token and then reads the contents of the file you created earlier. This code must run on the VM to be able to access the VM's managed identity endpoint. .NET Framework 4.6 or higher is required to use the access token method. Replace the value of `<URI to blob file>` accordingly. You can obtain this value by navigating to file you created and uploaded to blob storage and copying the **URL** under **Properties** the **Overview** page.
102
102
@@ -184,4 +184,4 @@ The response contains the contents of the file:
184
184
In this tutorial, you learned how enable a Windows VM's system-assigned identity to access Azure Storage. To learn more about Azure Storage, see:
This tutorial shows you how to access the Azure Resource Manager API using a Windows virtual machine with system-assigned managed identity enabled. Managed identities for Azure resources are automatically managed by Azure and enable you to authenticate to services that support Azure AD authentication without needing to insert credentials into your code. You learn how to:
24
+
This tutorial shows you how to access the Azure Resource Manager API using a Windows virtual machine with system-assigned managed identity enabled. Managed identities for Azure resources are automatically managed by Azure and enable you to authenticate to services that support Microsoft Entra authentication without needing to insert credentials into your code. You learn how to:
25
25
26
26
> [!div class="checklist"]
27
27
> * Grant your VM access to a Resource Group in Azure Resource Manager
@@ -43,7 +43,7 @@ This tutorial shows you how to access the Azure Resource Manager API using a Win
Using managed identities for Azure resources, your application can get access tokens to authenticate to resources that support Azure AD authentication. The Azure Resource Manager API supports Azure AD authentication. We grant this VM's identity access to a resource in Azure Resource Manager, in this case a Resource Group. We assign the [Reader](../../role-based-access-control/built-in-roles.md#reader) role to the managed-identity at the scope of the resource group.
46
+
Using managed identities for Azure resources, your application can get access tokens to authenticate to resources that support Microsoft Entra authentication. The Azure Resource Manager API supports Microsoft Entra authentication. We grant this VM's identity access to a resource in Azure Resource Manager, in this case a Resource Group. We assign the [Reader](../../role-based-access-control/built-in-roles.md#reader) role to the managed-identity at the scope of the resource group.
47
47
48
48
1. Sign in to the [Azure portal](https://portal.azure.com) with your administrator account.
49
49
1. Navigate to the tab for **Resource Groups**.
@@ -70,7 +70,7 @@ You'll need to use **PowerShell** in this portion. If you don’t have **PowerS
70
70
```
71
71
72
72
> [!NOTE]
73
-
> The value of the "resource" parameter must be an exact match for what is expected by Azure AD. When using the Azure Resource Manager resource ID, you must include the trailing slash on the URI.
73
+
> The value of the "resource" parameter must be an exact match for what is expected by Microsoft Entra ID. When using the Azure Resource Manager resource ID, you must include the trailing slash on the URI.
74
74
75
75
Next, extract the full response, which is stored as a JavaScript Object Notation (JSON) formatted string in the $response object.
Copy file name to clipboardExpand all lines: articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-cosmos-db.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,7 +61,7 @@ Next, add a data collection in the Azure Cosmos DB account that you can query in
61
61
62
62
## Grant access
63
63
64
-
This section shows how to grant Windows VM system-assigned managed identity access to the Azure Cosmos DB account access keys. Azure Cosmos DB does not natively support Azure AD authentication. However, you can use a system-assigned managed identity to retrieve an Azure Cosmos DB access key from Resource Manager, and use the key to access Azure Cosmos DB. In this step, you grant your Windows VM system-assigned managed identity access to the keys to the Azure Cosmos DB account.
64
+
This section shows how to grant Windows VM system-assigned managed identity access to the Azure Cosmos DB account access keys. Azure Cosmos DB does not natively support Microsoft Entra authentication. However, you can use a system-assigned managed identity to retrieve an Azure Cosmos DB access key from Resource Manager, and use the key to access Azure Cosmos DB. In this step, you grant your Windows VM system-assigned managed identity access to the keys to the Azure Cosmos DB account.
65
65
66
66
To grant the Windows VM system-assigned managed identity access to the Azure Cosmos DB account in Azure Resource Manager using PowerShell, update the following values:
67
67
@@ -97,7 +97,7 @@ You need to install the latest version of [Azure CLI](/cli/azure/install-azure-c
97
97
```
98
98
99
99
> [!NOTE]
100
-
> The value of the "resource" parameter must be an exact match for what is expected by Azure AD. When using the Azure Resource Manager resource ID, you must include the trailing slash on the URI.
100
+
> The value of the "resource" parameter must be an exact match for what is expected by Microsoft Entra ID. When using the Azure Resource Manager resource ID, you must include the trailing slash on the URI.
101
101
102
102
Next, extract the "Content" element, which is stored as a JavaScript Object Notation (JSON) formatted string in the $response object.
This tutorial shows you how to use a system-assigned managed identity for a Windows virtual machine (VM) to access an Azure Data Lake Store. Managed identities are automatically managed by Azure. They enable your application to authenticate to services that support Azure AD authentication, without needing to insert credentials into your code.
24
+
This tutorial shows you how to use a system-assigned managed identity for a Windows virtual machine (VM) to access an Azure Data Lake Store. Managed identities are automatically managed by Azure. They enable your application to authenticate to services that support Microsoft Entra authentication, without needing to insert credentials into your code.
25
25
26
26
In this article you learn how to:
27
27
@@ -68,7 +68,7 @@ Your VM's system-assigned managed identity can now perform all operations on fil
68
68
69
69
## Access data
70
70
71
-
Azure Data Lake Store natively supports Azure AD authentication, so it can directly accept access tokens obtained using managed identities for Azure resources. To authenticate to the Data Lake Store filesystem, you send an access token issued by Azure AD to your Data Lake Store filesystem endpoint in an Authorization header. The header has the format "Bearer <ACCESS_TOKEN_VALUE>". To learn more about Data Lake Store support for Azure AD authentication, read [Authentication with Data Lake Store using Azure Active Directory](../../data-lake-store/data-lakes-store-authentication-using-azure-active-directory.md)
71
+
Azure Data Lake Store natively supports Microsoft Entra authentication, so it can directly accept access tokens obtained using managed identities for Azure resources. To authenticate to the Data Lake Store filesystem, you send an access token issued by Microsoft Entra ID to your Data Lake Store filesystem endpoint in an Authorization header. The header has the format "Bearer <ACCESS_TOKEN_VALUE>". To learn more about Data Lake Store support for Microsoft Entra authentication, read [Authentication with Data Lake Store using Microsoft Entra ID](../../data-lake-store/data-lakes-store-authentication-using-azure-active-directory.md)
72
72
73
73
> [!NOTE]
74
74
> The Data Lake Store filesystem client SDKs do not yet support managed identities for Azure resources. This tutorial will be updated when support is added to the SDK.
@@ -195,4 +195,4 @@ Using other Data Lake Store filesystem APIs you can append to files, download fi
195
195
In this tutorial, you learned how to use a system-assigned managed identity for a Windows virtual machine to access an Azure Data Lake Store. To learn more about Azure Data Lake Store, see:
196
196
197
197
> [!div class="nextstepaction"]
198
-
>[Azure Data Lake Store](../../data-lake-store/data-lake-store-overview.md)
198
+
>[Azure Data Lake Store](../../data-lake-store/data-lake-store-overview.md)
This tutorial shows you how a Windows virtual machine (VM) can use a system-assigned managed identity to access [Azure Key Vault](../../key-vault/general/overview.md). Key Vault makes it possible for your client application to use a secret to access resources not secured by Azure Active Directory (Azure AD). Managed identities are automatically managed by Azure. They enable you to authenticate to services that support Azure AD authentication, without including authentication information in your code.
24
+
This tutorial shows you how a Windows virtual machine (VM) can use a system-assigned managed identity to access [Azure Key Vault](../../key-vault/general/overview.md). Key Vault makes it possible for your client application to use a secret to access resources not secured by Microsoft Entra ID. Managed identities are automatically managed by Azure. They enable you to authenticate to services that support Microsoft Entra authentication, without including authentication information in your code.
This section shows how to grant your VM access to a secret stored in a Key Vault. When you use managed identities for Azure resources, your code can get access tokens to authenticate to resources that support Azure AD authentication. However, not all Azure services support Azure AD authentication. To use managed identities for Azure resources with those services, store the service credentials in Azure Key Vault, and use the VM's managed identity to access Key Vault to retrieve the credentials.
44
+
This section shows how to grant your VM access to a secret stored in a Key Vault. When you use managed identities for Azure resources, your code can get access tokens to authenticate to resources that support Microsoft Entra authentication. However, not all Azure services support Microsoft Entra authentication. To use managed identities for Azure resources with those services, store the service credentials in Azure Key Vault, and use the VM's managed identity to access Key Vault to retrieve the credentials.
45
45
46
46
First, we need to create a Key Vault and grant our VM’s system-assigned managed identity access to the Key Vault.
# Tutorial: Use a Windows VM system-assigned managed identity to access Azure SQL
19
19
20
20
21
-
This tutorial shows you how to use a system-assigned identity for a Windows virtual machine (VM) to access Azure SQL Database. Managed Service Identities are automatically managed by Azure and enable you to authenticate to services that support Azure AD authentication, without needing to insert credentials into your code. You learn how to:
21
+
This tutorial shows you how to use a system-assigned identity for a Windows virtual machine (VM) to access Azure SQL Database. Managed Service Identities are automatically managed by Azure and enable you to authenticate to services that support Microsoft Entra authentication, without needing to insert credentials into your code. You learn how to:
22
22
23
23
> [!div class="checklist"]
24
24
>
25
25
> * Grant your VM access to Azure SQL Database
26
-
> * Enable Azure AD authentication
26
+
> * Enable Microsoft Entra authentication
27
27
> * Create a contained user in the database that represents the VM's system assigned identity
28
28
> * Get an access token using the VM identity and use it to query Azure SQL Database
29
29
@@ -41,36 +41,38 @@ To grant your VM access to a database in Azure SQL Database, you can use an exis
41
41
42
42
There are two steps to granting your VM access to a database:
43
43
44
-
1. Enable Azure AD authentication for the server.
44
+
1. Enable Microsoft Entra authentication for the server.
45
45
2. Create a **contained user** in the database that represents the VM's system-assigned identity.
46
46
47
-
### Enable Azure AD authentication
47
+
<aname='enable-azure-ad-authentication'></a>
48
48
49
-
**To [configure Azure AD authentication](/azure/azure-sql/database/authentication-aad-configure):**
49
+
### Enable Microsoft Entra authentication
50
+
51
+
**To [configure Microsoft Entra authentication](/azure/azure-sql/database/authentication-aad-configure):**
50
52
51
53
1. In the Azure portal, select **SQL servers** from the left-hand navigation.
52
-
2. Select the SQL server to be enabled for Azure AD authentication.
54
+
2. Select the SQL server to be enabled for Microsoft Entra authentication.
53
55
3. In the **Settings** section of the blade, click **Active Directory admin**.
54
56
4. In the command bar, click **Set admin**.
55
-
5. Select an Azure AD user account to be made an administrator of the server, and click **Select.**
57
+
5. Select a Microsoft Entra user account to be made an administrator of the server, and click **Select.**
56
58
6. In the command bar, click **Save.**
57
59
58
60
59
61
### Create contained user
60
62
61
-
This section shows how to create a contained user in the database that represents the VM's system assigned identity. For this step, you need [Microsoft SQL Server Management Studio](/sql/ssms/download-sql-server-management-studio-ssms) (SSMS). Before beginning, it may also be helpful to review the following articles for background on Azure AD integration:
63
+
This section shows how to create a contained user in the database that represents the VM's system assigned identity. For this step, you need [Microsoft SQL Server Management Studio](/sql/ssms/download-sql-server-management-studio-ssms) (SSMS). Before beginning, it may also be helpful to review the following articles for background on Microsoft Entra integration:
62
64
63
65
-[Universal Authentication with SQL Database and Azure Synapse Analytics (SSMS support for MFA)](/azure/azure-sql/database/authentication-mfa-ssms-overview)
64
-
-[Configure and manage Azure Active Directory authentication with SQL Database or Azure Synapse Analytics](/azure/azure-sql/database/authentication-aad-configure)
66
+
-[Configure and manage Microsoft Entra authentication with SQL Database or Azure Synapse Analytics](/azure/azure-sql/database/authentication-aad-configure)
65
67
66
-
SQL DB requires unique Azure AD display names. With this, the Azure AD accounts such as users, groups and Service Principals (applications), and VM names enabled for managed identity must be uniquely defined in Azure AD regarding their display names. SQL DB checks the Azure AD display name during T-SQL creation of such users and if it isn't unique, the command fails requesting to provide a unique Azure AD display name for a given account.
68
+
SQL DB requires unique Microsoft Entra ID display names. With this, the Microsoft Entra accounts such as users, groups and Service Principals (applications), and VM names enabled for managed identity must be uniquely defined in Microsoft Entra ID regarding their display names. SQL DB checks the Microsoft Entra ID display name during T-SQL creation of such users and if it isn't unique, the command fails requesting to provide a unique Microsoft Entra ID display name for a given account.
67
69
68
70
**To create a contained user:**
69
71
70
72
1. Start SQL Server Management Studio.
71
73
2. In the **Connect to Server** dialog, Enter your server name in the **Server name** field.
72
74
3. In the **Authentication** field, select **Active Directory - Universal with MFA support**.
73
-
4. In the **User name** field, enter the name of the Azure AD account that you set as the server administrator, for example, [email protected]
75
+
4. In the **User name** field, enter the name of the Microsoft Entra account that you set as the server administrator, for example, [email protected]
74
76
5. Click **Options**.
75
77
6. In the **Connect to database** field, enter the name of the non-system database you want to configure.
76
78
7. Click **Connect**. Complete the sign-in process.
@@ -103,7 +105,7 @@ Code running in the VM can now get a token using its system-assigned managed ide
103
105
104
106
## Access data
105
107
106
-
This section shows how to get an access token using the VM's system-assigned managed identity and use it to call Azure SQL. Azure SQL natively supports Azure AD authentication, so it can directly accept access tokens obtained using managed identities for Azure resources. This method doesn't require supplying credentials on the connection string.
108
+
This section shows how to get an access token using the VM's system-assigned managed identity and use it to call Azure SQL. Azure SQL natively supports Microsoft Entra authentication, so it can directly accept access tokens obtained using managed identities for Azure resources. This method doesn't require supplying credentials on the connection string.
107
109
108
110
Here's a .NET code example of opening a connection to SQL using Active Directory Managed Identity authentication. The code must run on the VM to be able to access the VM's system-assigned managed identity's endpoint. **.NET Framework 4.6.2**or higher or**.NET Core 3.1**or higher is required to use this method. Replace the values of AZURE-SQL-SERVERNAME and DATABASE accordingly and add a NuGet reference to the Microsoft.Data.SqlClient library.
109
111
@@ -179,4 +181,3 @@ In this tutorial, you learned how to use a system-assigned managed identity to a
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments