You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -25,7 +25,7 @@ Previously, only an SMI could be assigned to the Azure SQL Managed Instance or S
25
25
26
26
In addition to using a UMI and an SMI as the instance or server identity, you can use them to access the database by using the SQL connection string option `Authentication=Active Directory Managed Identity`. You need to create a SQL user from the managed identity in the target database by using the [CREATE USER](/sql/t-sql/statements/create-user-transact-sql) statement. For more information, see [Using Microsoft Entra authentication with SqlClient](/sql/connect/ado-net/sql/azure-active-directory-authentication).
27
27
28
-
To retrieve the current UMI(s) or SMI for Azure SQL Managed instance or Azure SQL Database, see [Get or set a managed identity for a logical server or managed instance](#get-or-set-a-managed-identity-for-a-logical-server-or-managed-instance) later in this article.
28
+
To retrieve the current UMIs or SMI for Azure SQL Managed instance or Azure SQL Database, see [Get or set a managed identity for a logical server or managed instance](#get-or-set-a-managed-identity-for-a-logical-server-or-managed-instance) later in this article.
29
29
30
30
## Benefits of using user-assigned managed identities
31
31
@@ -61,6 +61,29 @@ These permissions should be granted before you provision a logical server or man
61
61
-[GroupMember.Read.All](/graph/permissions-reference#group-permissions): Allows access to Microsoft Entra group information.
62
62
-[Application.Read.ALL](/graph/permissions-reference#application-resource-permissions): Allows access to Microsoft Entra service principal (application) information.
63
63
64
+
### Permissions for SMI
65
+
66
+
The same Microsoft Graph applications are needed for the SMI, but the UMI permissions can be eliminated for Azure SQL Database using an SMI. The `CREATE USER` T-SQL syntax would need the `SID` and `TYPE` syntax, as described in the article, [CREATE USER (Transact-SQL)](/sql/t-sql/statements/create-user-transact-sql#syntax).
67
+
68
+
```syntaxsql
69
+
CREATE USER
70
+
{
71
+
Microsoft_Entra_principal FROM EXTERNAL PROVIDER [ WITH <limited_options_list> [ ,... ] ]
72
+
| Microsoft_Entra_principal WITH <options_list> [ ,... ]
73
+
}
74
+
[ ; ]
75
+
76
+
<limited_options_list> ::=
77
+
DEFAULT_SCHEMA = schema_name
78
+
| OBJECT_ID = 'objectid'
79
+
<options_list> ::=
80
+
DEFAULT_SCHEMA = schema_name
81
+
| SID = sid
82
+
| TYPE = { X | E }
83
+
```
84
+
85
+
The above syntax allows creation of Microsoft Entra users without validation. For this to work, the `Object Id` of the Microsoft Entra principal would have to be supplied and used as an `SID` in the T-SQL statement, as explained in [Create a contained database user from a Microsoft Entra principal without validation](/sql/t-sql/statements/create-user-transact-sql#k-create-a-contained-database-user-from-a-microsoft-entra-principal-without-validation).
86
+
64
87
### Grant permissions
65
88
66
89
The following sample PowerShell script grants the necessary permissions for a managed identity. This sample assigns permissions to the user-assigned managed identity `umiservertest`.
@@ -149,7 +172,7 @@ The Azure portal displays the system-assigned managed identity (SMI) ID in the *
149
172
150
173
:::image type="content" source="media/authentication-azure-ad-user-assigned-managed-identity/get-system-assigned-managed-identity-azure-sql-server-azure-portal.png" alt-text="Screenshot of the Azure portal page for an Azure SQL Database logical server. In the Properties menu, the System Assigned Managed Identity is highlighted.":::
151
174
152
-
- To retrieve the UMI(s) for Azure SQL Managed Instance or Azure SQL Database, use the following PowerShell or Azure CLI examples.
175
+
- To retrieve the UMIs for Azure SQL Managed Instance or Azure SQL Database, use the following PowerShell or Azure CLI examples.
153
176
- To retrieve the SMI for Azure SQL Managed Instance, use the following PowerShell or Azure CLI examples.
154
177
155
178
### Set a managed identity in the Azure portal
@@ -211,7 +234,7 @@ The Azure CLI 2.26.0 (or later) is required to run these commands with a UMI.
211
234
212
235
- To provision a new server with a UMI, use the [New-AzSqlServer](/powershell/module/az.sql/new-azsqlserver) command.
213
236
- To obtain the managed identities for a logical server, use the [Get-AzSqlServer](/powershell/module/az.sql/get-azsqlserver) command.
214
-
- For example, to retrieve the UMI(s) of a logical server, look for the `principalId` of each:
237
+
- For example, to retrieve the UMIs of a logical server, look for the `principalId` of each:
Copy file name to clipboardExpand all lines: docs/t-sql/statements/create-user-transact-sql.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: CREATE USER (Transact-SQL)
4
4
author: VanMSFT
5
5
ms.author: vanto
6
6
ms.reviewer: wiassaf, jaszymas
7
-
ms.date: 11/20/2024
7
+
ms.date: 04/08/2025
8
8
ms.service: sql
9
9
ms.subservice: t-sql
10
10
ms.topic: reference
@@ -121,8 +121,8 @@ CREATE USER user_name
121
121
DEFAULT_SCHEMA = schema_name
122
122
| DEFAULT_LANGUAGE = { NONE | lcid | language name | language alias }
123
123
| SID = sid
124
-
| ALLOW_ENCRYPTED_VALUE_MODIFICATIONS = [ ON | OFF ] ]
125
-
124
+
| ALLOW_ENCRYPTED_VALUE_MODIFICATIONS = [ ON | OFF ] ]
125
+
126
126
<limited_options_list> ::=
127
127
DEFAULT_SCHEMA = schema_name ]
128
128
| ALLOW_ENCRYPTED_VALUE_MODIFICATIONS = [ ON | OFF ] ]
@@ -160,7 +160,7 @@ CREATE USER Microsoft_Entra_principal FROM EXTERNAL PROVIDER
160
160
[;]
161
161
```
162
162
163
-
Syntax for [!INCLUDE [fabric-sqldb](../../includes/fabric-sqldb.md)]
163
+
Syntax for [!INCLUDE [fabric-sqldb](../../includes/fabric-sqldb.md)] and Azure SQL Database
164
164
165
165
```syntaxsql
166
166
CREATE USER
@@ -274,7 +274,7 @@ CREATE USER user_name
274
274
In SQL database in Microsoft Fabric, `sid` should be a valid ID of the specified Microsoft Entra principal. If the principal is a user or a group, the ID should be a Microsoft Entra object ID of the user/group. If the Microsoft Entra principal is a service principal (an application or a managed identity), the ID should be an application ID (or a client ID). The specified ID must be a `binary(16)` value. The [!INCLUDE[ssDE](../../includes/ssde-md.md)] doesn't validate the specified ID in Microsoft Entra. The `SID` argument must be used together with `TYPE`.
275
275
276
276
#### TYPE = [ E | X ]
277
-
**Applies to**: SQL database in Microsoft Fabric.
277
+
**Applies to**: SQL database in Microsoft Fabric and Azure SQL Database.
278
278
279
279
Specifies the type of a Microsoft Entra principal. `E` indicates the principal is a user or a service principal (an application or a managed identity). `X` indicates the principal is a group.
280
280
@@ -577,7 +577,7 @@ GO
577
577
578
578
### K. Create a contained database user from a Microsoft Entra principal without validation
0 commit comments