Skip to content

Commit

Permalink
Update Azure SQL server guide with Entra ID
Browse files Browse the repository at this point in the history
  • Loading branch information
@greedy52
greedy52 committed Nov 7, 2024
1 parent 440dc0b commit ab98ed1
Show file tree
Hide file tree
Showing 4 changed files with 13 additions and 11 deletions.
Binary file modified docs/img/database-access/guides/sqlserver/azure-set-ad-admin.png
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/img/database-access/guides/sqlserver/cloud-sql-aad.png
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/img/database-access/guides/sqlserver/sql-aad.png
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
24 changes: 13 additions & 11 deletions ...enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx
View file
Original file line number Diff line number Diff line change
@@ -1,32 +1,32 @@
---
title: Database Access with SQL Server on Azure
description: How to configure Teleport database access with Azure SQL Server using Azure Active Directory authentication.
description: How to configure Teleport database access with Azure SQL Server using Microsoft Entra authentication.
---

(!docs/pages/includes/database-access/db-introduction.mdx dbType="Azure SQL Server" dbConfigure="with Microsoft Entra ID-based authentication"!)

## How it works

The Teleport Database Service runs on an Azure virtual machine with an attached
Azure identity with permissions to retrieve authentication tokens from Azure
Active Directory. When a user connects to SQL Server with Teleport, the Teleport
Azure identity with permissions to retrieve authentication tokens from
Microsoft Entra ID. When a user connects to SQL Server with Teleport, the Teleport
Database service authenticates with Azure AD, then uses an authentication token
to connect to SQL Server. The Database Service then forwards user traffic to the
database.

<Tabs>
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
![Teleport Database Access Azure SQL Server Azure Active Directory Self-Hosted](../../../../img/database-access/guides/sqlserver/sql-aad.png)
![Teleport Database Access Azure SQL Server Microsoft Entra Self-Hosted](../../../../img/database-access/guides/sqlserver/sql-aad.png)

Check failure on line 19 in docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx

View workflow job for this annotation

GitHub Actions / Lint docs prose style 

[vale] reported by reviewdog 🐶
[messaging.protocol-products] Avoid the impression that Teleport consists of multiple products for secure access, e.g., "Database Access" or "Server Access". Instead, talk about enrolling resources in your Teleport cluster, protecting resources with Teleport, or the ability for Teleport to proxy various protocols.

Raw Output:
{"message": "[messaging.protocol-products] Avoid the impression that Teleport consists of multiple products for secure access, e.g., \"Database Access\" or \"Server Access\". Instead, talk about enrolling resources in your Teleport cluster, protecting resources with Teleport, or the ability for Teleport to proxy various protocols.", "location": {"path": "docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx", "range": {"start": {"line": 19, "column": 12}}}, "severity": "ERROR"}
</TabItem>
<TabItem scope={["cloud"]} label="Teleport Enterprise Cloud">
![Teleport Database Access Azure SQL Server Azure Active Directory Cloud](../../../../img/database-access/guides/sqlserver/cloud-sql-aad.png)
![Teleport Database Access Azure SQL Server Microsoft Entra Cloud](../../../../img/database-access/guides/sqlserver/cloud-sql-aad.png)

Check failure on line 22 in docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx

View workflow job for this annotation

GitHub Actions / Lint docs prose style 

[vale] reported by reviewdog 🐶
[messaging.protocol-products] Avoid the impression that Teleport consists of multiple products for secure access, e.g., "Database Access" or "Server Access". Instead, talk about enrolling resources in your Teleport cluster, protecting resources with Teleport, or the ability for Teleport to proxy various protocols.

Raw Output:
{"message": "[messaging.protocol-products] Avoid the impression that Teleport consists of multiple products for secure access, e.g., \"Database Access\" or \"Server Access\". Instead, talk about enrolling resources in your Teleport cluster, protecting resources with Teleport, or the ability for Teleport to proxy various protocols.", "location": {"path": "docs/pages/enroll-resources/database-access/enroll-azure-databases/azure-sql-server-ad.mdx", "range": {"start": {"line": 22, "column": 12}}}, "severity": "ERROR"}
</TabItem>

</Tabs>

## Prerequisites

Database access for Azure SQL Server with Azure Active Directory authentication
Database access for Azure SQL Server with Microsoft Entra authentication
is available starting from Teleport `11.0`.

(!docs/pages/includes/edition-prereqs-tabs.mdx!)
Expand All @@ -39,20 +39,20 @@ is available starting from Teleport `11.0`.

(!docs/pages/includes/database-access/create-user.mdx!)

## Step 2/8. Enable the SQL Server Azure Active Directory integration
## Step 2/8. Enable the Microsoft Entra authentication

If you have it enabled, you can go to the next step.

Go to the [Azure Portal](https://portal.azure.com/), select **Database
servers**, and select the database you wish to enable the Azure Active Directory
integration.
servers**, and select the database you wish to enable the Microsoft Entra
authentication.

Select **Azure Active Directory** in the left-hand column.
Select **Microsoft Entra ID** under "Settings" in the left-hand column.

Select **Set Admin**, and choose an account that will be added as an admin
login to SQL Server.

![Azure SQL Server Azure Active Directory admin page](../../../../img/database-access/guides/sqlserver/azure-set-ad-admin.png)
![Azure SQL Server Microsoft Entra admin page](../../../../img/database-access/guides/sqlserver/azure-set-ad-admin.png)

## Step 3/8. Configure IAM permissions for Teleport

Expand Down Expand Up @@ -282,3 +282,5 @@ To check if the VM has access, you can do the following on the VM:

(!docs/pages/includes/database-access/guides-next-steps.mdx!)

## Further reading
- [Microsoft Entra authentication for Azure SQL](https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview?view=azuresql)

0 comments on commit ab98ed1

Please sign in to comment.