Privileged identity management (PIM) and ADS do not play well

[shahiddev]

Type: Bug

Hi,
We use Entra Privileged Identity Management (PIM) to allow our team to be added to groups that have elevated privs on our SQL DBs in a JIT manner.

When a user is granted access via PIM their new permissions are not reflected in ADS unless they first clear the token cache, restart ADS and then re-sync their account.

Up until version 1.43 all we had to do was to remove and re-add the Azure account in ADS.
All versions since 1.43 this process has not longer worked and needs the explicitly token cache clearing and restarting ADS which is not ideal
This issue is related to one I reported a long time ago that was closed

This is an issue with the way the token's are being cached - I'm unclear as to what changed since 1.43 that has broken the previous behaviour - potentially the switch related MSAL ?

Azure Data Studio version: azuredatastudio 1.48.0 (4970733, 2024-02-27T00:05:08.293Z)
OS version: Windows_NT x64 10.0.22621
Restricted Mode: No
Preview Features: Enabled
Modes:

[rgrace-puck]

Experiencing this too. The query editor in the Azure Portal sees updated privileges but Azure Data Studio still hangs onto old credentials somewhere.

[jason-berk-k1x]

so, from what I can tell.....if you use PIM to let people join a group that allows elevated database access..... for example, a PROD DB READERS group that people can PIM into. Once they pim into that role and get connected with ADS.....it appears that long (hours and days) after the PIM escalation expired and the user is no longer in the group, they can STILL access the production database until they clear the token or restart ADS.....

that's what I'm seeing on my mac (ARM64) running ADS......

talk about a security hole.......