{"id":110113,"date":"2026-05-05T12:00:00","date_gmt":"2026-05-05T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=110113"},"modified":"2026-05-05T07:08:40","modified_gmt":"2026-05-05T07:08:40","slug":"managed-identities-in-sql-server-2025-a-complete-guide","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/managed-identities-in-sql-server-2025-a-complete-guide\/","title":{"rendered":"What are managed identities in SQL Server 2025? A complete guide"},"content":{"rendered":"\n

Learn how managed identities in SQL Server 2025 enhance security by eliminating passwords and enabling seamless Microsoft Entra authentication for Azure resources.<\/strong><\/p>\n\n\n\n

Those who have worked with SQL Server<\/a> will understand the need to avoid storing passwords for accessing resources. Windows-based identities are fine for on-premises SQL Server systems, including those on cloud-based virtual machines (VMs)<\/a>, but are of no use when you need to access cloud-based resources like those in Azure<\/a>.<\/p>\n\n\n\n

Some Azure-based resources (including storage<\/a> accounts) offer other access methods, such as shared access signatures (SAS)<\/a>, but these aren’t much of a step-up from passwords. <\/p>\n\n\n\n

What’s really needed is for SQL Server to have its own Microsoft Entra<\/a> based identity. These can<\/em> be used directly with Azure-based resources – and that’s exactly where managed identities come in.<\/p>\n\n\n\n

What are managed identities?<\/h2>\n\n\n\n

A managed identity is a Microsoft Entra identity that Azure creates and manages for a resource. This allows the resource to obtain tokens for other Azure services without the need for storing passwords, client secrets, or certificates in code or configuration. Two types of managed identities are available.<\/p>\n\n\n\n

First, a system-assigned managed identity, which is specific to a resource. For example, I could add a system-assigned managed identity to an Azure Data Factory (ADF)<\/a>. The ADF could then use the identity when making connections to, or accessing, other resources. When the ADF is deleted, the system-assigned managed identity is also removed.<\/p>\n\n\n\n

Then there’s a user-assigned managed identity. This is created independently of any specific resource and can be applied to a resource, in addition to any system-assigned managed identity. User-assigned managed identities are very powerful because a single identity can be assigned to multiple resources.<\/p>\n\n\n\n

For example, I might have a single identity for a group of data factories. This simplifies the configuration of access and, importantly, if I need to recreate the data factory, I can use the same identity. Even when all the data factories are deleted, the user-assigned managed identity can survive. Another common use for these is to assign the same identity to a group of web servers.<\/p>\n\n\n\n

The official Microsoft documentation for managed identities can be found here<\/a>.<\/em><\/p>\n\n\n\n

Why managed identities are not just<\/em> service principals<\/h2>\n\n\n\n

Under the covers, managed identities are a special kind of service principal<\/a>, but there are important differences. The major one is that service principals expire, whereas Azure manages the lifecycle and credential rotation of managed identities for you. <\/p>\n\n\n\n

I’m always concerned when I see solutions built using service principals without plans for what would happen when they expire. These are like time-bombs at many sites today, but using managed identities avoids these issues. The credential expires after 90 days and is rolled over after 45 days.<\/p>\n\n\n\n

The biggest contrast is operational. With a service principal, someone must create an app registration, issue and protect a secret or certificate, and periodically rotate that credential. That might also require updating dependent systems.<\/p>\n\n\n\n

\n
\n
\n
\n

Fast, reliable and consistent SQL Server development…<\/h3>\n
\n …with SQL Toolbelt Essentials. 10 ingeniously simple tools for accelerating development, reducing risk, and standardizing workflows. <\/div>\n <\/div>\n Learn more & try for free<\/a>\n <\/div>\n <\/div>\n<\/section>\n\n\n

What’s needed to use a managed identity?<\/h2>\n\n\n\n

To be able to use managed identities, you need two things:<\/p>\n\n\n

\n