Using arcpy.mapping to change user for SDE connections using Microsoft Entra MFA authentication

[StephenCochrane]

Hi

I have a complex aprx which have been setup using a sde connections to a MS SQL server enterprise geodatabase. The connection is using Microsoft Entra MFA authentication.

I want to make this aprx available for a multiple users each using their own credentials when connecting to the database. So basically, I would like to create a copy of the aprx for each user based on the template aprx I have defined in an automated process. Is that possible?

I have experimented using ArcPy.mapping module which we have uses for manipulating datasources in aprxs previous. But it does not seem work when using Microsoft Entra MFA authentication.

I have tried the following:

import arcpy

aprx = arcpy.mp.ArcGISProject(r"C:\dev\MyProject\MyProject.aprx")
aprx.updateConnectionProperties(r"C\dev\MyProject\EntraMFA.sde",
r"C:\dev\MyProject\EntraMFATestUser.sde")
aprx.saveACopy(r"C:\dev\MyProject\MyProjectUpdated.aprx")

where EntraMFA.sde file is the connection for the user that was used to create the template aprx. The EntraMFATestUser.sde is the connection for a test user that we would like to prepare a copy of the aprx for.

When the code is executed for a simple test aprx with 3 layers (from one single enterprise database) the password dialog is promted 9 times - and I imagine that will be much worse when template aprx get more complex with multiple maps and layers. But what is even worse is that passwords that should be provided are both for the user that created the template aprx and the user that should use in the new aprx. This is not a feasible solution as we do not share passwords between users.

I have also tried using the connectionProperties dictionary option from arcpy.mapping library and changing only the username property. This does not seem to work at all. After execution the property is not updated at all.

Best regards

Stephen

[ShannonShields]

Stephen,

changing the .sde file in a project is not going to change the connection information stored in each individual layer. If you are using the UpdateConnectionProperties to swap out the .sde file, that is only changing the .sde file in the project. You'd have to update the individual layers one at a time.

However, when using Entra MFA the user is still going to need to supply their credentials at least once. If all the layers are from the same database, the first prompt to supply credentials should then apply to all the remaining layers.

Have you tried testing simply creating a project with a few layers pulled from a single connection made with MFA and with 'save user/password' unchecked and having another user open the project? In my testing (using ArcGIS Pro 3.3) I am only prompted for my MFA credentials once when opening a project containing layers that I have permission to see but that were added by another MFA login.

-Shannon