Connecting to Azure SQL Database using EntraID MFA

[GeomaticsPublisher]

Hi,

We are migrating our on-prem SQL windows server to Microsoft Azure and have been testing Azure SQL Database as a PaaS alternative to a windows server deployment method. Our organsiation uses Microsoft EntraID using MFA as the required method to connect to sevices such as our SQL databases however have been struggling to get this method working using azure sql database. We have successfuly so far::

• deployed an sql database through the azure poral
• enabled the entreprise geodatbase through ArcGIS Pro (3.4.3) - (Note: ODBC 17 drivers are installed)
• connected to the database using the standard database authenticiation method (gisowner, pword).
• created a user role group
• using SQL Server Managemnt Studio 20 added an Entra user to the database using their MFA and added them to a user group. They can successfully connected to the database directly though SSMS.

When we try to connect to the azure SQL database through ArcGIS Pro using Microsoft EntraMFA method however we are recieving a 'bad login user' message. We recive the same error message on all Entra authoenticiation menthods.

Is there any advice / documentation / help that could be provided as to how/ if it's possible to connect to an azure SQL database using our  Entra a/c using MFA?

Many Thanks in advance

Philip

[RClavero]

Hello @GeomaticsPublisher, 

Is SSMS installed in the same machine as ArcGIS Pro?

And, have you tried using the Diagnostic Monitor while testing the Azure SQL database connection? I would give it a try; maybe you'll see some extra logs there that could help with the troubleshooting.

[GeomaticsPublisher]

Hi, Thanks for the reply,

Yes we have SSMS installed on the machine (azure virtual desktop) as ArcPro is installed on. We can connect in SSMS to the database using our EntraID MFA.

Thanks for the diagnostics monitor tip - i'll take a look

[CarlTurner1]

There is a 32 character limit on usernames when connecting to an Enterprise Geodatabase. It is very easy to exceed this when accessing through EntraID as the '@MyDomain.com' is included in the character count. My company's domain accounts for 21 characters. 

[mrajeb]

From what I understand, this is a known limitation—ArcGIS Pro does not currently support Microsoft Entra ID authentication with MFA when connecting to Azure SQL Database. This explains why it works in SQL Server Management Studio but fails in ArcGIS Pro.

As a workaround, we may need to continue using SQL authentication for ArcGIS connections, or consider a controlled exception (e.g. non-MFA Entra access) depending on security policies.