I need your advice about entra-docs HOT 5 CLOSED

Dear Saibaba, Thank you for your response. The computer the application will run on is not an Azure VM, it is a physical computer or a local VM on the customer’s premises. I’m sure you can help me with the below, too. This article: Managed Service Accounts: Understanding, Implementing, Best Practices, and Troubleshooting | Microsoft Learn<https://learn.microsoft.com/en-us/archive/blogs/askds/managed-service-accounts-understanding-implementing-best-practices-and-troubleshooting> tells how to create a managed service account in AD and make a service run as this account by referencing it as DOMAINNAME\USERNAME$. If our AD is integrated with Microsoft Entra ID, and the data are stored in an Azure SQL Database, and I want the application that is running on a physical computer to access those data, then may I do what is written in the article above, or do I have to create the gMSA in Entra ID? Or, as our AD and Entra ID are integrated and synchronized, does it not matter where I create the gMSA? If it exist in both or AD and Entra ID due to synchronization, may I reference it as DOMAINNAME\USERNAME$ when I configure a service to run as this account? I apologize for the ‘stupid’ questions but this subject is quite new to me. Regards, Attila From: Saibaba Balapur Hireka ***@***.***> Sent: Monday, December 18, 2023 5:11 AM To: MicrosoftDocs/entra-docs ***@***.***> Cc: Ats, Attila ***@***.***>; Mention ***@***.***> Subject: Re: [MicrosoftDocs/entra-docs] I need your advice (Issue #73) CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. @AttilaAts<https://github.com/AttilaAts> It is possible to use a managed identity to access Azure SQL Database from a Windows service running on a Windows VM. However, it is not possible to use a managed identity from a computer that is a member of a Windows AD domain that is linked to Microsoft Entra ID. Managed identities are only available for Azure resources, not for on-premises resources. In your case, you can use a managed service account to run the Windows service and connect to the Azure SQL database. Alternatively, you can use a service principal to authenticate to Azure SQL Database. To use a service principal, you need to create an Azure AD application and assign it the necessary permissions to access Azure SQL Database. You can then use the client ID and client secret of the Azure AD application to authenticate to Azure SQL Database. Here is a tutorial that walks you through the process of using a Windows VM system-assigned managed identity to access Azure SQL Database: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql. I hope this helps! Let me know if you have any further questions. — Reply to this email directly, view it on GitHub<#73 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ANHIUROJ75GJSETU5BBGKKDYJ664NAVCNFSM6AAAAABAU6PZX6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNJZGUZDAMJXGE>. You are receiving this because you were mentioned.Message ID: ***@***.***>