-You can use PowerShell to grant required permissions to the managed identity. Alternatively, you can [create a role-assignable group](/entra/identity/role-based-access-control/groups-create-eligible). After the group is created, assign the **Directory readers** role or `User.Read.All`, `GroupMember.Read.All`, and `Application.Read.All` to the group, and [add all system-assigned managed identities for your Arc-enabled machines to the group](https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-directory-readers-role-tutorial?view=azuresql). We do not recommend using Directory reader in the production.
0 commit comments