Skip to content

Commit d9a28fe

Browse files
rwestMSFTrwestMSFT
authored
Merge pull request #36070 from VanMSFT/vanmsft-sql-security-managed-identity-linked-server
Add managed identity support documentation for linked servers on SQL Server 2025
2 parents bbdc5ab + 2fca65e commit d9a28fe

4 files changed

Lines changed: 262 additions & 28 deletions

File tree

‎docs/relational-databases/security/authentication-access/azure-ad-authentication-sql-server-linked-server.md‎

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,29 @@
11
---
2-
title: "Linked server for SQL Server with Microsoft Entra authentication"
2+
title: "Linked Server for SQL Server with Microsoft Entra Authentication"
33
description: Learn about how to use linked server for SQL Server with Microsoft Entra authentication
44
author: PratimDasgupta
55
ms.author: prdasgu
66
ms.reviewer: vanto, randolphwest
7-
ms.date: 07/25/2022
7+
ms.date: 12/15/2025
88
ms.service: sql
99
ms.subservice: security
10-
ms.topic: conceptual
11-
monikerRange: ">=sql-server-ver15||>= sql-server-linux-ver16"
12-
ms.custom: sfi-image-nochange
10+
ms.topic: article
11+
ms.custom:
12+
- sfi-image-nochange
13+
monikerRange: ">=sql-server-ver15 || >=sql-server-linux-ver16"
1314
---
1415

1516
# Linked server for SQL Server with Microsoft Entra authentication
1617

17-
[!INCLUDE [SQL Server 2022](../../../includes/applies-to-version/sqlserver2022.md)]
18+
[!INCLUDE [SQL Server 2022 and later](../../../includes/applies-to-version/sqlserver2022-and-later.md)]
1819

19-
[Linked servers](../../linked-servers/linked-servers-database-engine.md) can now be configured using [authentication](azure-ad-authentication-sql-server-overview.md) with Microsoft Entra ID ([formerly Azure Active Directory](/entra/fundamentals/new-name)), and it supports two mechanisms for providing credentials:
20+
[Linked servers](../../linked-servers/linked-servers-database-engine.md) can now be configured using [authentication](azure-ad-authentication-sql-server-overview.md) with Microsoft Entra ID ([formerly Azure Active Directory](/entra/fundamentals/new-name)), and it supports three mechanisms for providing credentials:
2021

2122
- Password
2223
- Access token
24+
- Managed identity (SQL Server 2025 and later)
25+
26+
This article covers password and access token authentication. For SQL Server 2025 and later, you can also use managed identity authentication for linked servers. For more information, see [Configure managed identity for linked servers](../../../sql-server/azure-arc/managed-identity-support-linked-server.md).
2327

2428
This article assumes there are two SQL Server instances (`S1` and `S2`). Both have been configured to support Microsoft Entra authentication, and they trust each other's SSL/TLS certificate. The examples in this article are executed on server `S1` to create a linked server to server `S2`.
2529

@@ -28,10 +32,10 @@ This article assumes there are two SQL Server instances (`S1` and `S2`). Both ha
2832
- Fully operational Microsoft Entra authentication for SQL Server. For more information, see [Microsoft Entra authentication for SQL Server](azure-ad-authentication-sql-server-overview.md) and [Tutorial: Set up Microsoft Entra authentication for SQL Server](azure-ad-authentication-sql-server-setup-tutorial.md).
2933
- [SQL Server Management Studio (SSMS)](/ssms/install/install) version 18.0 or higher.
3034

31-
> [!NOTE]
35+
> [!NOTE]
3236
> The subject name of the SSL/TLS certificate used by `S2` must match the server name provided in the [`provstr`](../../system-stored-procedures/sp-addlinkedserver-transact-sql.md) attribute. This should either be the Fully Qualified Domain Name (**FQDN**) or **hostname** of `S2`.
3337
34-
<a name='linked-server-configurations-for-azure-ad-authentication'></a>
38+
<a id="linked-server-configurations-for-azure-ad-authentication"></a>
3539

3640
## Linked server configurations for Microsoft Entra authentication
3741

@@ -54,7 +58,7 @@ For password authentication, using `Authentication=ActiveDirectoryPassword` in t
5458
- **Provider string**: `Server=<fqdn of S2>;Authentication=ActiveDirectoryPassword`.
5559
- **Catalog**: leave empty.
5660

57-
:::image type="content" source="media/create-linked-server-with-password-authentication.png" alt-text="Screenshot of creating linked server with password authentication":::
61+
:::image type="content" source="media/create-linked-server-with-password-authentication.png" alt-text="Screenshot of creating linked server with password authentication." lightbox="media/create-linked-server-with-password-authentication.png":::
5862

5963
1. Select the **Security** tab.
6064
1. Select **Add**.
@@ -65,13 +69,13 @@ For password authentication, using `Authentication=ActiveDirectoryPassword` in t
6569
- **For a login not defined in the list above, connections will**: `Not be made`
6670
1. Select **OK**.
6771

68-
:::image type="content" source="media/linked-server-add-security.png" alt-text="Screenshot of setting security for linked server":::
72+
:::image type="content" source="media/linked-server-add-security.png" alt-text="Screenshot of setting security for linked server." lightbox="media/linked-server-add-security.png":::
6973

7074
### Linked server configuration using access token authentication
7175

7276
For access token authentication, the linked server is created with `AccessToken=%s` in the **Provider string**. A linked server login is created to map each login in `S1` to a [Microsoft Entra application](/azure/azure-sql/database/authentication-aad-service-principal), which has been granted login permissions to `S2`. The application must have a secret assigned to it, which will be used by `S1` to generate the access token. A secret can be created by navigating to the [Azure portal](https://portal.azure.com) > **Microsoft Entra ID** > **App registrations** > `YourApplication` > **Certificates & secrets** > **New client secret**.
7377

74-
:::image type="content" source="media/application-new-client-secret.png" alt-text="Screenshot of creating a new client secret for an application in the Azure portal":::
78+
:::image type="content" source="media/application-new-client-secret.png" alt-text="Screenshot of creating a new client secret for an application in the Azure portal." lightbox="media/application-new-client-secret.png":::
7579

7680
1. In SSMS, connect to `S1` and expand **Server Objects** in the **Object Explorer** window.
7781
1. Right-click **Linked Servers** and select **New Linked Server**.
@@ -84,7 +88,7 @@ For access token authentication, the linked server is created with `AccessToken=
8488
- **Provider string**: `Server=<fqdn of S2>;AccessToken=%s`.
8589
- **Catalog**: leave empty.
8690

87-
:::image type="content" source="media/create-linked-server-with-access-token-authentication.png" alt-text="Screenshot of creating linked server with access token authentication":::
91+
:::image type="content" source="media/create-linked-server-with-access-token-authentication.png" alt-text="Screenshot of creating linked server with access token authentication." lightbox="media/create-linked-server-with-access-token-authentication.png":::
8892

8993
1. Select the **Security** tab.
9094
1. Select **Add**.
@@ -95,8 +99,9 @@ For access token authentication, the linked server is created with `AccessToken=
9599
- **For a login not defined in the list above, connections will**: `Not be made`
96100
1. Select **OK**.
97101

98-
## See also
102+
## Related content
99103

100-
- [Connect SQL Server to Azure Arc](../../../sql-server/azure-arc/connect.md)
104+
- [Configure managed identity for linked servers](../../../sql-server/azure-arc/managed-identity-support-linked-server.md)
105+
- [Connect your SQL Server to Azure Arc](../../../sql-server/azure-arc/connect.md)
101106
- [Microsoft Entra authentication for SQL Server](azure-ad-authentication-sql-server-overview.md)
102-
- [Tutorial: Set up Microsoft Entra authentication for SQL Server](azure-ad-authentication-sql-server-setup-tutorial.md)
107+
- [Tutorial: Set up Microsoft Entra authentication for SQL Server with app registration](azure-ad-authentication-sql-server-setup-tutorial.md)

‎docs/relational-databases/system-stored-procedures/sp-addlinkedserver-transact-sql.md‎

Lines changed: 87 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: "sp_addlinkedserver (Transact-SQL)"
44
author: markingmyname
55
ms.author: maghan
66
ms.reviewer: wiassaf, randolphwest, mikeray
7-
ms.date: 08/21/2025
7+
ms.date: 12/15/2025
88
ms.service: sql
99
ms.subservice: system-objects
1010
ms.topic: "reference"
@@ -61,7 +61,7 @@ The unique programmatic identifier (PROGID) of the OLE DB provider that correspo
6161

6262
- Starting with [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], `MSOLEDBSQL` uses Microsoft OLE DB Driver version 19, which adds support for [TDS 8.0](../security/networking/tds-8.md). However, this driver introduces a breaking change. You must now specify the `encrypt` parameter. Use `encrypt` to define whether or not encryption is mandatory. You must provide a valid CA-signed certificate to encrypt your connection to another SQL Server instance, or assign `encrypt=optional` in the *@provstr* argument. If you can't modify the linked server configuration, enable trace flag 17600 to maintain OLE DB version 18 behavior and defaults.
6363

64-
For details about encryption properties, review [Major version differences](../../connect/oledb/major-version-differences.md).
64+
For details about encryption properties, review [Major version differences](../../connect/oledb/major-version-differences.md).
6565

6666
> [!IMPORTANT]
6767
> [!INCLUDE [snac-removed-oledb-only](../../includes/snac-removed-oledb-only.md)]
@@ -132,13 +132,13 @@ The following table shows the ways that a linked server can be set up for data s
132132
| [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] | [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Native Client OLE DB Provider | [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] <sup>1</sup> (default) | | | | | |
133133
| [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] | [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Native Client OLE DB Provider | | `SQLNCLI` | Network name of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] (for default instance) | | | Database name (optional) |
134134
| [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] | [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Native Client OLE DB Provider | | `SQLNCLI` | *servername*\\*instancename* (for specific instance) | | | Database name (optional) |
135-
| Oracle, version 8 and later | Oracle Provider for OLE DB | Any | `OraOLEDB.Oracle` | Alias for the Oracle database | | | |
136-
| Access/Jet | Microsoft OLE DB Provider for Jet | Any | `Microsoft.Jet.OLEDB.4.0` | Full path of Jet database file | | | |
137-
| ODBC data source | Microsoft OLE DB Provider for ODBC | Any | `MSDASQL` | System DSN of ODBC data source | | | |
138-
| ODBC data source | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for ODBC | Any | `MSDASQL` | | | ODBC connection string | |
139-
| File system | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for Indexing Service | Any | `MSIDXS` | Indexing Service catalog name | | | |
140-
| [!INCLUDE [msCoName](../../includes/msconame-md.md)] Excel Spreadsheet | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for Jet | Any | `Microsoft.Jet.OLEDB.4.0` | Full path of Excel file | | Excel 5.0 | |
141-
| IBM Db2 Database | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for DB2 | Any | `DB2OLEDB` | | | See [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for DB2 documentation. | Catalog name of DB2 database |
135+
| Oracle, version 8 and later | Oracle Provider for OLE DB | Any <sup>2</sup> | `OraOLEDB.Oracle` | Alias for the Oracle database | | | |
136+
| Access/Jet | Microsoft OLE DB Provider for Jet | Any <sup>2</sup> | `Microsoft.Jet.OLEDB.4.0` | Full path of Jet database file | | | |
137+
| ODBC data source | Microsoft OLE DB Provider for ODBC | Any <sup>2</sup> | `MSDASQL` | System DSN of ODBC data source | | | |
138+
| ODBC data source | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for ODBC | Any <sup>2</sup> | `MSDASQL` | | | ODBC connection string | |
139+
| File system | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for Indexing Service | Any <sup>2</sup> | `MSIDXS` | Indexing Service catalog name | | | |
140+
| [!INCLUDE [msCoName](../../includes/msconame-md.md)] Excel Spreadsheet | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for Jet | Any <sup>2</sup> | `Microsoft.Jet.OLEDB.4.0` | Full path of Excel file | | Excel 5.0 | |
141+
| IBM Db2 Database | [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for DB2 | Any <sup>2</sup> | `DB2OLEDB` | | | See [!INCLUDE [msCoName](../../includes/msconame-md.md)] OLE DB Provider for DB2 documentation. | Catalog name of DB2 database |
142142

143143
<sup>1</sup> This way of setting up a linked server forces the name of the linked server to be the same as the network name of the remote instance of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)]. Use *@datasrc* to specify the server.
144144

@@ -158,6 +158,21 @@ The stored procedure `sp_addlinkedserver` can't be executed within a user-define
158158
> [!IMPORTANT]
159159
> When a linked server is created by using `sp_addlinkedserver`, a default self-mapping is added for all local logins. For non-[!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] providers, [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Authenticated logins might be able to gain access to the provider under the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] service account. Administrators should consider using `sp_droplinkedsrvlogin <linkedserver_name>, NULL` to remove the global mapping.
160160
161+
## Managed identity authentication for SQL Server 2025
162+
163+
**Applies to**: [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] and later versions
164+
165+
[!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] introduces support for managed identity authentication when creating linked servers between SQL Server instances. This feature allows SQL Server instances running on Azure Virtual Machines or Azure Arc-enabled servers to use managed identities for secure, credential-free authentication to other SQL Server instances.
166+
167+
Managed identity authentication is supported when the following requirements are met:
168+
169+
- The source SQL Server instance is running on an Azure Virtual Machine with a system-assigned or user-assigned managed identity enabled, or on an Azure Arc-enabled server with a system-assigned managed identity configured.
170+
- The destination is another SQL Server instance with Microsoft Entra authentication configured.
171+
- A login matching the source server's name has been created on the destination SQL Server instance from an external provider.
172+
- The connection uses the Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) with `Authentication=ActiveDirectoryMSI` in the provider string.
173+
174+
For detailed configuration steps, see [Configure managed identity for linked servers](../../sql-server/azure-arc/managed-identity-support-linked-server.md).
175+
161176
## Permissions
162177

163178
The `sp_addlinkedserver` statement requires the `ALTER ANY LINKED SERVER` permission. (The [!INCLUDE [ssManStudioFull](../../includes/ssmanstudiofull-md.md)] **New Linked Server** dialog box is implemented in a way that requires membership in the **sysadmin** fixed server role.)
@@ -186,7 +201,7 @@ EXECUTE sp_addlinkedserver
186201
@datasrc = N'S1\instance1';
187202
```
188203

189-
The following example creates the linked server `S1_instance1` but uses the Microsoft OLE DB Driver Version 19 in [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], with the `encrypt=optional` parameter:
204+
The following example creates the linked server `S1_instance1` but uses the Microsoft OLE DB Driver Version 19 in [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], with the `encrypt=optional` parameter:
190205

191206
```sql
192207
EXECUTE sp_addlinkedserver
@@ -197,7 +212,7 @@ EXECUTE sp_addlinkedserver
197212
@datasrc = N'S1\instance1';
198213
```
199214

200-
The following example creates the linked server `S1_instance1` using the Microsoft OLE DB Driver Version 19 in [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], with the `encrypt=mandatory` parameter. This option requires a valid certificate, the self-signed certificate is not accepted.
215+
The following example creates the linked server `S1_instance1` using the Microsoft OLE DB Driver Version 19 in [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], with the `encrypt=mandatory` parameter. This option requires a valid certificate. The self-signed certificate isn't accepted.
201216

202217
```sql
203218
EXECUTE sp_addlinkedserver
@@ -208,7 +223,7 @@ EXECUTE sp_addlinkedserver
208223
@datasrc = N'S1\instance1';
209224
```
210225

211-
The following example creates the linked server `S1_instance1` using the Microsoft OLE DB Driver Version 19 in [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], with `encrypt=mandatory` and `trustservercertificate=yes`. Because **Trust Server Certificate** is set to `yes`, self-signed certificates are accepted.
226+
The following example creates the linked server `S1_instance1` using the Microsoft OLE DB Driver Version 19 in [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], with `encrypt=mandatory` and `trustservercertificate=yes`. Because **Trust Server Certificate** is set to `yes`, self-signed certificates are accepted.
212227

213228
```sql
214229
EXECUTE sp_addlinkedserver
@@ -476,6 +491,66 @@ EXECUTE sp_addlinkedserver
476491

477492
For more information, see [Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) (recommended)](../../connect/oledb/oledb-driver-for-sql-server.md#1-microsoft-ole-db-driver-for-sql-server-msoledbsql-recommended).
478493

494+
### K. Create a linked server with managed identity authentication for SQL Server 2025
495+
496+
**Applies to**: [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] and later versions
497+
498+
The following example creates a linked server from a source [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] instance to a destination SQL Server instance using managed identity authentication. This scenario requires that the source SQL Server instance is running on an Azure Virtual Machine or Azure Arc-enabled server with a managed identity enabled, and that the destination SQL Server has Microsoft Entra authentication configured.
499+
500+
Before creating the linked server on the source, you must create a login on the destination SQL Server that matches the source server's name:
501+
502+
```sql
503+
-- Run on the destination SQL Server instance
504+
USE [master];
505+
GO
506+
507+
CREATE LOGIN [SourceServerName]
508+
FROM EXTERNAL PROVIDER;
509+
GO
510+
511+
ALTER SERVER ROLE [sysadmin] ADD MEMBER [SourceServerName];
512+
GO
513+
```
514+
515+
On the source SQL Server, create the linked server using the Microsoft OLE DB Driver for SQL Server with `ActiveDirectoryMSI` authentication:
516+
517+
```sql
518+
-- Run on the source SQL Server instance
519+
EXECUTE master.dbo.sp_addlinkedserver
520+
@server = N'DestinationSQLServer',
521+
@srvproduct = N'',
522+
@provider = N'MSOLEDBSQL',
523+
@datasrc = N'DestinationSQLServer',
524+
@provstr = N'Authentication=ActiveDirectoryMSI';
525+
GO
526+
```
527+
528+
Configure the linked server login mapping:
529+
530+
```sql
531+
EXECUTE master.dbo.sp_addlinkedsrvlogin
532+
@rmtsrvname = N'DestinationSQLServer',
533+
@useself = N'False',
534+
@locallogin = NULL,
535+
@rmtuser = NULL,
536+
@rmtpassword = NULL;
537+
GO
538+
```
539+
540+
Test the linked server connection:
541+
542+
```sql
543+
-- Test the connection
544+
EXECUTE master.dbo.sp_testlinkedserver DestinationSQLServer;
545+
GO
546+
547+
-- Query the remote server
548+
SELECT * FROM [DestinationSQLServer].[master].[sys].[databases];
549+
GO
550+
```
551+
552+
For complete configuration details including managed identity setup, Microsoft Entra authentication configuration, and permissions, see [Configure managed identity for linked servers](../../sql-server/azure-arc/managed-identity-support-linked-server.md).
553+
479554
## Related content
480555

481556
- [Distributed Queries stored procedures (Transact-SQL)](distributed-queries-stored-procedures-transact-sql.md)

0 commit comments

Comments
 (0)