I am required to migrate an on-prem ASP.Net web application with its SQL Server 2019 backend to Azure.
The Web application initial migration must be IaaS (Windows VMs running IIS).
The SQL 2019 has to be Azure SQL PaaS (Not Azure SQL Managed instance).
The existing on-prem Web application has several virtual directories, and each application in a virtual directory, is in a separate IIS app pool.
Each app pool is run under the context of a different domain service account.
Connection to the SQL databases is via integrated security.
In the current on-prem solution, the domain service accounts are added as logins to the SQL Server and each has permissions to one or more of the databases (Execute / Connect permissions; addition to datareader role etc).
I believe there will have a domain join to Azure AD, so the on-prem AD service accounts will be accessible in azure (as far as I can understand).
SQL Azure does not support CREATE LOGIN [MYDOMAIN\MYSVCACCOUNT] FROM WINDOWS;
Is there a way I can setup the existing on-prem domain accounts with the access, permissions and roles in the SQL PaaS solution, to mirror the current on-prem setup?
Alternatively, could someone could help me identify resources for best practice for the architecture described.
Thank you
I found a a few good posts that assisted me to understand all available options:
https://www.mssqltips.com/sqlservertip/5242/adding-users-to-azure-sql-databases/
https://learn.microsoft.com/en-gb/azure/azure-sql/database/logins-create-manage
Related
I've got an Azure App Service that needs access to a classic SQL Server (non-Azure SQL, not SQL Managed Instance) and I'd prefer to do this via System Managed Identity. This is enabled on the App Service and a corresponding Enterprise Application is created on Azure AD.
The SQL Server is also connected to this Azure AD and User accounts on the AD already have access to the database. However I can't find how to create a login for the Enterprise Application. If this was an Azure SQL database I could do it with CREATE LOGIN [AZUREAD\app] FROM EXTERNAL PROVIDER but this does not work on a classic SQL Server, only on Azure SQL/MI.
A solution would be to use SQL accounts and reference the login/password in the connection strings, but as mentioned I'd much rather use Azure AD for authentication.
To answer my own question: SQL Server 2022 includes Azure AD authentication Link
Using integrated security or an access token it will be possible to authenticate with an App Registration.
This is currently in preview with no RTM date specified.
If I use one of the methods to migrate a SQL server instance with several databases into a Azure Managed Instance, would the procedure also replicate any login accounts with access rights?
Particular interested in knowing how this handles Active Directory accounts
From what I know, it doesn't and you cannot use Windows Authentication but only SQL Server Authentication or Azure AD. I've migrated several times a local database of my local SQL Server instance to Azure and I've done it using Export Data-Tier to .bacpac (this is the extension of the DB in Azure) and then deploying it (both actions from SSMS):
However, please be aware that you have to drop any users that use for authentication Windows Authentication because you'll get an error at the moment of deploying it since it cannot inherit your server's active directory settings. Then, you can define your own AD in Azure and use it.
Managed instance is a new deployment option of Azure SQL Database, providing near 100% compatibility with the latest SQL Server on-premises (Enterprise Edition) Database Engine.
The migration only support replicate the login.
You could get this from this document: Tutorial: Migrate SQL Server to an Azure SQL Database managed instance offline using DMS:
By default, Azure Database Migration Service only supports migrating SQL logins. To enable support for migrating Windows logins, see the Prerequisites section of this tutorial.
That means you must re-create all the users and grant it access right(database roles) manually.
Hope this helps.
I would like to know if it's possible to use Active Directory integrated security within Azure Webapp Standard version to access Azure VM SQL Server.
We have an Azure VM with SQL Server installed and joined into an Azure Directory Domain Services. The VM/SQLServer is being restricted to be accessed only within the VNet, so this VM has no Public IP.
The Webapp is connected via VNet Integration to the VNet of the AD DS and VM's.
if someone could explain me if that possible/not possible to implement such a solution and what are the options that I havein AZure to use the integrated security.
Edit: Regarding managed identity in AZure Web App, only certain Azure Resources that can have a Managed Identity assigned, which here the Web App is one of them.
And to be able to access a resource using MI that resource needs to support Azure AD Authentication, this is limited to specific resources:
Source: Services that support managed identities for Azure resources
- Azure Resource Manager
- Azure Key Vault
- Azure Data Lake
- Azure SQL
- Azure Event Hubs and Service Bus
- Azure Storage
The Azure vm SQL Server is not listed as one of the resources that can be accessed through AD managed identity.
if someone could explain me if that possible/not possible to implement such a solution and what are the options that I havein AZure to use the integrated security.
Yes, it's possible. You could configure your App Service app to use Azure Active Directory to access Azure VM sql server.
Work Flow:
The VNet Integration feature is built on top of point-to-site VPN technology. Apps in Azure App Service are hosted in a multi-tenant system, which precludes provisioning an app directly in a VNet. The point-to-site technology limits network access to just the virtual machine hosting the app. Apps are restricted to only send traffic out to the internet, through Hybrid Connections or through VNet Integration.
For more details, you could refer to this article.
I have an application written in VB, which used to connect with a Microsoft SQL Server, which is placed on a VM in the domain, using Windows Authentication(Local Domain).
But, I have moved my DB to a SQL Server which is placed on an Azure VM.
My problem is that i don't know how i can use Windows Authentication(or somehow to "ask" the Active Directory about the user who tries to connect).
I have seen the modes of SQL Server:
Active Directory - Password
Active Directory - Integrated
but i can't understand how i can use them. Should i have to do trust relation between 2 domain(Local, Azure)?
Can someone help?
I have moved my DB to a SQL Server which is placed on an Azure VM.
SQL on an Azure VM is the same product you might run on-premises, and supports SQL Auth and Windows Integrated Auth. The Azure Active Directory authentication methods supported by Azure SQL Database and Azure SQL Data Warehouse are not applicable to SQL Server running in an Azure VM. See:
Azure Active Directory authentication is a mechanism of connecting to
Azure SQL Database and SQL Data Warehouse by using identities in Azure
Active Directory (Azure AD).
See Use Azure Active Directory Authentication for authentication with SQL Database, Managed Instance, or SQL Data Warehouse
For SQL Server running in an Azure VM you use either SQL Authentication or Windows Authenticationl, as outlined here Authentication in SQL Server
You can use Windows Auth in your VM with either local accounts (created on the VM), or you can deploy a Domain Controller on a separate VM into your VMs VNET and use identities from the Domain. The Domain Controller you deploy into your Azure VNET can be an isolated Domain, or it can be a replica for your on-premises domain. If you want to deploy a replica of your on-premises domain into an Azure VNET you also will need to use a site-to-site VPN or ExpressRoute, as explained here Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines
I need to connect my web app on Azure to our on site SQL Server instance via Windows authentication (not via SQL Server account authentication). Active Directory is already integrated with the on-site AD and therefore all of the users are available there.
My question is, is it possible to hook up an azure web app to an on-site SQL Server via Windows authentication.
is it possible to hook up an azure web app to an on-site SQL Server via Windows authentication.
Base on my option, it maybe that we couldn’t do that. As we have been limited to do that operation for azure WebApp. There is also another SO thread mentioned that.
If we want to connect to on premise SQL Server, we can use hybrid connections to access on-premises SQL server database in Azure WebApp, more info please refer to the document.
If we want to authenticate the WebApp with local Active Directory, and we have an on-premises secure token service (STS) like Active Directory Federation Services (AD FS), we could use that to federate authentication for our Azure WebApp. More info please refer to the document.
Hybrid connections at this time does not support AD accounts due to
because you cannot domain join an App Service worker