Use a managed identity to connect Azure SQL Database to an app deployed to Azure Spring Apps
Note
The Basic, Standard, and Enterprise plans will be deprecated starting from mid-March, 2025, with a 3 year retirement period. We recommend transitioning to Azure Container Apps. For more information, see the Azure Spring Apps retirement announcement.
The Standard consumption and dedicated plan will be deprecated starting September 30, 2024, with a complete shutdown after six months. We recommend transitioning to Azure Container Apps. For more information, see Migrate Azure Spring Apps Standard consumption and dedicated plan to Azure Container Apps.
This article applies to: ✔️ Java ✔️ C#
This article applies to: ✔️ Basic/Standard ✔️ Enterprise
This article shows you how to create a managed identity for an app deployed to Azure Spring Apps and use it to access Azure SQL Database.
Azure SQL Database is the intelligent, scalable, relational database service built for the cloud. It’s always up to date, with AI-powered and automated features that optimize performance and durability. Serverless compute and Hyperscale storage options automatically scale resources on demand, so you can focus on building new applications without worrying about storage size or resource management.
Prerequisites
- An Azure account with an active subscription. Create an account for free.
- Azure CLI version 2.45.0 or higher.
- Follow the Spring Data JPA tutorial to provision an Azure SQL Database and get it work with a Java app locally.
- Follow the Azure Spring Apps system-assigned managed identity tutorial to provision an app in Azure Spring Apps with managed identity enabled.
Connect to Azure SQL Database with a managed identity
You can connect your application to an Azure SQL Database with a managed identity by following manual steps or using Service Connector.
Grant permission to the managed identity
Connect to your SQL server and run the following SQL query:
CREATE USER [<managed-identity-name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<managed-identity-name>];
ALTER ROLE db_datawriter ADD MEMBER [<managed-identity-name>];
ALTER ROLE db_ddladmin ADD MEMBER [<managed-identity-name>];
GO
The value of the <managed-identity-name> placeholder follows the rule <service-instance-name>/apps/<app-name>; for example: myspringcloud/apps/sqldemo. You can also use the following command to query the managed identity name with Azure CLI:
az ad sp show --id <identity-object-ID> --query displayName
Configure your Java app to use a managed identity
Open the src/main/resources/application.properties file, then add Authentication=ActiveDirectoryMSI; at the end of the spring.datasource.url line, as shown in the following example. Be sure to use the correct value for the $AZ_DATABASE_NAME variable.
spring.datasource.url=jdbc:sqlserver://$AZ_DATABASE_NAME.database.windows.net:1433;database=demo;encrypt=true;trustServerCertificate=false;hostNameInCertificate=*.database.windows.net;loginTimeout=30;Authentication=ActiveDirectoryMSI;
Build and deploy the app to Azure Spring Apps
Rebuild the app and deploy it to the Azure Spring Apps provisioned in the second bullet point under Prerequisites. You now have a Spring Boot application authenticated by a managed identity that uses JPA to store and retrieve data from an Azure SQL Database in Azure Spring Apps.