Installation > Authenticating PTC Modeler using Microsoft Entra ID > Azure Portal Configuration > Allow Entra ID users to access SQL Server from Azure VM
Allow Entra ID users to access SQL Server from Azure VM
This topic provides a set of instructions to allow Microsoft Entra ID users to securely connect to a SQL Server instance installed on an Azure Virtual Machine using Windows Authentication and Multi-Factor Authentication (MFA).
Prerequisites
• Azure subscription with permissions to create resources
• Microsoft Entra ID
• Azure CLI
• Bastion for secure VM access
• SQL Server installation media
Perform all of the following steps to allow the Microsoft Entra ID users to access SQL Server from an Azure VM.
Step 1: Enable Multi-factor Authentication (MFA)
1. Sign in to the Microsoft Entra admin center.
2. Navigate to Users > Multi-Factor Authentication.
3. Enable MFA for the users.
Step 2: Create Azure Virtual Machine
1. Create a new Virtual Machine from Azure Portal or from the Azure CLI.
2. During VM creation, in the Management tab, enable Login with Entra ID.
For any existing VMs, you can enable this setting from the Identity section in the VM configuration.
Step 3: Assign RBAC role to Entra users
1. Navigate to Azure VM > Access Control (IAM).
2. Click Add > Add Role Assignment.
3. Select one of the following roles:
◦ Virtual Machine Administrator Login
◦ Virtual Machine User Login
4. Assign the roles to the required Entra users.
5. Click Save.
Step 4: Install SQL Server on the Azure VM
1. Connect to the Azure VM.
2. Install SQL Server (any supported edition).
3. During setup, when prompted for the authentication mode, select Windows Authentication Mode.
4. Complete SQL installation.
Step 5: Register SQL Server VM with Azure SQL IaaS Extension
You can use Azure CLI to register the SQL Server VM:
az sql vm create \
    name <VM name>\
    resource-group <Resource Group Name>\
    license-type <AHUB | PAYG>
AHUB = Azure Hybrid Benefit
PAYG = Pay-As-You-Go
The following is an example of registering a SQL Server VM with Azure:
az sql vm create \
   name ENTRA-SERVER-01 \
   resource-group ENTRA-MODELER \
   license-type AHUB
* 
You must restart the SQL Server and other services from the SQL Server network configuration.
Step 6: Verify SQL VM Registration
Navigate to Azure Portal > SQL Server on Azure Virtual Machines.. Ensure that the newly installed VM is listed and available.
Step 7: Enable Entra Authentication in SQL VM
1. Open SQL Server VM settings.
2. Enable the following:
◦ Entra Authentication
◦ System assigned Managed identity
Step 8: Assign Directory Readers Role
This step is required if the SQL Server needs to query Entra users for login validation.
1. Open Microsoft Entra admin center.
2. Navigate to Roles and Administrators > Directory Readers.
3. Click Add Assignment.
4. Select the Enterprise Application (your SQL VM’s Managed Identity).
5. Click Assign.
Step 9: Add Entra Users as SQL Server Logins
1. Open SQL Management Studio (SSMS).
2. Connect with a user with administrative privileges.
3. Navigate to Security > Logins > New Login.
4. In the Login Name, enter your Entra user in the domain\username OR [email protected] format.
5. Select Windows Authentication.
6. Grant appropriate permissions to the user (for example, db_datareader, db_owner, etc.).
Repeat the steps for all users.
Was this helpful?