Microsoft Entra ID Integrated Authentication

This topic only applies to Secret Server On-Premises.

Secret Server can connect to a database hosted on Azure SQL Database or Azure SQL Managed Instance using Microsoft Entra ID (formerly Azure AD) integrated authentication. With this method, Secret Server does not store a database user name or password. It uses the Windows identity of the IIS application pool to obtain a Microsoft Entra ID access token and presents that token to Azure SQL.

This topic explains how the option relates to the other SQL authentication options in the installer, what you need before you select it, and how to select it. For the other options, see Installing and Configuring SQL Server.

In the installer, this option is currently labeled Microsoft Entra ID (password). Despite the label, the installer does not prompt for a user name or password when it is selected. Do not confuse it with Azure Active Directory Authentication using Application Identity, which does prompt for Microsoft Entra ID user credentials.

SQL Authentication Options Compared

The installer offers four ways to authenticate to SQL Server. The first column shows the label as it appears in the installer.

Installer label Authenticates as Credentials entered in the installer Typical use
Windows Authentication using Application Identity The IIS application pool identity, using Integrated Windows Authentication None SQL Server on your own network. Recommended.
Azure Active Directory Authentication using Application Identity A Microsoft Entra ID user, using that user's name and password Username and Password Azure SQL. Depends on a deprecated Microsoft library and is not recommended for production use.
Microsoft Entra ID (password) The IIS application pool identity, using Microsoft Entra ID integrated authentication (this topic) None Azure SQL, when the web server is joined to a domain that is synchronized with your Microsoft Entra tenant.
SQL Server authentication A SQL Server login Username and Password Evaluations and quick setups. Requires SQL Server mixed mode.

Prerequisites

  • An Azure SQL Database or Azure SQL Managed Instance with Microsoft Entra authentication enabled and a Microsoft Entra admin assigned. See Configure and manage Microsoft Entra authentication with Azure SQL in the Microsoft documentation.

  • The Secret Server web server is joined to an on-premises Active Directory domain that is synchronized or federated with the Microsoft Entra tenant that manages the Azure SQL server. Integrated authentication obtains the token from the Windows sign-in of the application pool identity, so that identity must resolve to a Microsoft Entra user. See Using Microsoft Entra authentication with SqlClient in the Microsoft documentation.

  • The IIS application pool for Secret Server runs as a domain service account from that domain. See Running the IIS Application Pool As a Service Account.

  • The Secret Server database already exists, and the service account has a contained database user in it with the db_owner role. Create the database before running the installer. Then, connected to that database as the Microsoft Entra admin, run:

    CREATE USER [svc-secretserver@contoso.com] FROM EXTERNAL PROVIDER;
ALTER ROLE db_owner ADD MEMBER [svc-secretserver@contoso.com];

  • The web server can reach Microsoft Entra ID over HTTPS to request tokens.

The install wizard does not offer a managed identity option. Microsoft Entra ID integrated authentication as described here always uses the Windows identity of the application pool.

Selecting the Option in the Installer

  1. On the Unable to access database page, click Install Secret Server for a new installation, or Configure database to reconnect to an existing Secret Server database. For the full installation procedure, see Advanced (Manual) Installation.

  2. In Server name, enter the fully qualified name of the Azure SQL server, for example myserver.database.windows.net.

  3. In Database name, enter the name of the database you created.

  4. Under SQL Authentication, select Microsoft Entra ID (password). No Username or Password fields appear.

  5. Under Advanced configuration, ensure TLS encryption is enabled. Azure SQL requires encrypted connections. Leave Always trust server certificate disabled; Azure SQL presents a certificate from a public certificate authority.

  6. Click Install Secret Server (new installation) or Save connection information (reconnect).

Troubleshooting

  • "Database setup failed" or "Login failed for user ''" on a new installation. Fresh installations of Secret Server 12.0.000020 and later that select a credential-free option (Windows Authentication or Microsoft Entra ID integrated authentication) can fail with this error. The issue is fixed in 12.2.000007. Until you upgrade, use the Legacy install link at the bottom of the Unable to access database page, which opens the previous installer at /Setup/Database.

  • "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'" or a token acquisition error. The application pool identity is not a domain account that Microsoft Entra ID recognizes. Confirm the application pool runs as the synchronized service account, not as a built-in account such as ApplicationPoolIdentity or Network Service.

  • "Login failed for user '<token-identified principal>'". The token was issued, but the account has no user in the database. Create the contained user and grant db_owner as shown in Prerequisites.

Related Microsoft Documentation