Use Microsoft Entra ID (formerly Azure AD) authentication in DPA

You can use Microsoft Entra ID authentication in DPA if one or both of the following conditions apply to your environment:

• Your repository database is Azure SQL.
• You are monitoring one or more Azure SQL databases.

This form of authentication is only available if the DPA server is running on a Windows operating system.

Note: This feature for LDAP auth with the above steps will not work if the Azure instance also has Multi-factor authentication turned on for the instance. This is a known limitation. 

https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication 

https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-server 

1. If you are using DPA 11.1 or earlier, complete the following steps. (If you are using DPA 12.0 or later, continue with step 2.)
   1. On the DPA server, download and run ENU\x64\adalsql.msi from Microsoft.
   2. Download and run enu\sqljdbc_6.0.7728.100_enu.exe from Microsoft.
   3. Copy sqljdbc_auth.dll from Microsoft JDBC Driver 6.0 for SQL Server\sqljdbc_6.0\enu\auth\x64 to C:\Windows\System32 on the DPA server.
   4. Restart DPA.
2. Add the Active Directory admin to the Logical Server where the monitored database is located. See this document from Microsoft for more information.
3. Connect to the Azure database with an Active Directory account and execute the appropriate script:
   • For an Azure SQL repository database

     CREATE USER [activeDirectoryUser@*.onmicrosoft.com] FROM EXTERNAL PROVIDER WITH DEFAULT_SCHEMA = [ignite];
     ALTER ROLE db_owner ADD member [activeDirectoryUser@*.onmicrosoft.com];
     GO
     CREATE SCHEMA [ignite] AUTHORIZATION [activeDirectoryUser@*.onmicrosoft.com];

   • For a monitored Azure SQL database

     CREATE USER [activeDirectoryUser@*.onmicrosoft.com] FROM EXTERNAL PROVIDER;
     ALTER ROLE db_owner ADD member [activeDirectoryUser@*.onmicrosoft.com];

4. In DPA, run the Create Repository or Register Instance wizard.
5. When entering the connection information, click Advanced Connection Properties.

6. If you are using DPA 11.1 or earlier, enter the following in the JDBC URL Properties field and click OK:

   Authentication=ActiveDirectoryPassword;HostNameInCertificate=*.database.windows.net

   Note: If you are using DPA 12.0 or later, the ActiveDirectoryPassword is added automatically when @ is detected in the user name, and the HostNameInCertificate is part of every Azure connection. 

7. Click I'll create the contained user or login, and enter credentials.
8. Complete the wizard.