RELATED IDEAS
Support Microsoft Entra Managed Identity authentication for Azure SQL (Application Workspace server database connection)
Application Workspace currently supports only SQL Server Authentication and “Azure Active Directory - Password” for the server’s database connection. For deployments with Azure SQL Database, this is increasingly a problem:
Many organizations configure Azure SQL logical servers for Microsoft Entra-only authentication, which disables SQL authentication entirely. This is Microsoft’s recommended baseline and is enforced by common Azure Policy and landing zone frameworks.
Active Directory Integrated requires a domain-joined host and cannot be used on Entra-joined Azure VMs.
Active Directory Password is deprecated by Microsoft, based on the ROPC flow, incompatible with enforced MFA and relies on a user account as service account. Security reviews in regulated industries (banking, insurance, public sector) typically reject it.
As a result, Application Workspace cannot be deployed against Azure SQL in environments that follow current Microsoft security guidance.
Request: Add “Authentication=Active Directory Managed Identity” (system-assigned and user-assigned) as a supported authentication method for the Application Workspace server database connection, including installer and connection string configuration. Managed identity is Microsoft’s recommended method for unattended services on Azure infrastructure, removes the need for stored credentials and is supported by the current drivers (ODBC Driver 17/18, OLE DB Driver MSOLEDBSQL, Microsoft.Data.SqlClient).
Related: The prerequisite “SQL Server Native Client must be installed for Entra authentication” in the article “Install the first Application Workspace Server” is outdated. SNAC 11 does not support Entra authentication and has been removed from SQL Server 2022. The documentation should reference the current drivers instead.
Business impact
Without managed identity support, Application Workspace cannot use Azure SQL in Entra-only environments. Customers either have to request policy exceptions for SQL authentication, which security teams often refuse, or fall back to a self-managed SQL Server on the server VM, losing managed backups, Transparent Data Encryption and high availability.
References
https://learn.microsoft.com/en-us/sql/connect/ado-net/sql/azure-active-directory-authentication
https://learn.microsoft.com/en-us/sql/connect/driver-feature-matrix
https://learn.microsoft.com/en-us/sql/relational-databases/native-client/sql-server-native-client
