Use a managed identity with SQL MI

[BernieWhite]

Existing rule

No response

Suggested rule

Use managed identities to access Azure AD and other Azure resources.

Pillar

Security

Additional context

• https://learn.microsoft.com/azure/architecture/framework/security/design-identity-authentication#use-identity-based-authentication
• https://learn.microsoft.com/azure/templates/microsoft.sql/managedinstances
• https://learn.microsoft.com/azure/azure-sql/database/authentication-azure-ad-user-assigned-managed-identity?view=azuresql-mi

Managed Identities is required for Azure AD authentication.

You must enable the instance identity (SMI or UMI) to allow support for Azure AD authentication in SQL Managed Instance. For SQL Database, enabling the server identity is optional and required only if an Azure AD service principal (Azure AD application) oversees creating and managing Azure AD users, groups, or applications in the server. For more information, see Azure Active Directory service principal with Azure SQL.