You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Starting with [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)], you can use [managed identity](../../sql-server/azure-arc/managed-identity.md) to access the following Azure resources:
-[SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md)
22
-
- Enable `sp_configure 'allow server scoped db credentials'`
25
+
- Enable the `allow server scoped db credentials` server configuration option
26
+
- Give the managed identity access to the Azure Blob Storage resource.
23
27
24
28
## Update the registry
25
29
26
30
> [!WARNING]
27
-
> Incorrectly editing the registry can severely damage your system. Before making changes to the registry, we recommend you back up any valued data on the computer.
Update the registry subkey `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQLServer\FederatedAuthentication`. Add the following entries for your data storage types.
33
+
Update the registry subkey `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQLServer\FederatedAuthentication`. Add the following entries for your data storage types:
30
34
31
35
| Entry | Value |
32
36
| --- | --- |
33
37
|`AADDataLakeEndPoint`|`datalake.azure.net`|
34
-
|`AADAzureStorageEndPoint`|`storage.azure.com`|
38
+
|`AADAzureStorageEndpoint`|`storage.azure.com`|
39
+
40
+
### Registry example
41
+
42
+
The following example script inserts the registry keys for a [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] named instance called `SQL25Inst`, if it doesn't already exist:
Write-Host "Created registry value '$name' with '$($values[$name])'"
67
+
}
68
+
else {
69
+
Write-Host "Registry value '$name' already exists. Skipping..."
70
+
}
71
+
}
72
+
```
35
73
36
-
These keys are in addition to the registry keys required as described in [Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md?tabs=manual#update-the-registry).
74
+
Add these keys along with the keys described in [Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md?tabs=manual#update-the-registry).
37
75
38
76
## Create database scoped credentials
39
77
40
78
Add a database scoped credential for managed identity.
41
79
42
-
1. Allow server scoped database credentials. Run the following command.
80
+
1. Allow server scoped database credentials. Run the following Transact-SQL query:
43
81
44
82
```sql
45
-
EXECUTE sp_configure 'allow server scoped db credentials',1;
83
+
EXECUTE sp_configure 'allow server scoped db credentials',1;
46
84
GO
47
85
RECONFIGURE;
48
86
```
49
87
50
-
1. Create a database scoped credential. The example uses the name `managed_id`.
88
+
1. Create a database scoped credential. This example uses the name `managed_id`:
51
89
52
90
```sql
53
91
CREATEDATABASESCOPED CREDENTIAL [managed_id]
@@ -56,18 +94,49 @@ Add a database scoped credential for managed identity.
56
94
57
95
## Create external data source
58
96
59
-
Create the external data source.
97
+
Create the external data source with the following settings.
98
+
99
+
### [Azure Storage account (V2)](#tab/asav2)
100
+
101
+
-**Connector location prefix**
102
+
-`abs`
103
+
104
+
-**Location path**
105
+
-`abs://<container_name>@<storage_account_name>.blob.core.windows.net/`, or
[!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] supports for Manage Identity through Azure Arc. For instructions, review[Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md).
137
+
[!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] supports for managed identity through Azure Arc. For instructions, see[Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md).
69
138
70
-
The following example queries a parquet file in Azure Blob Storage
139
+
The following example queries a Parquet file in Azure Blob Storage:
71
140
72
141
```sql
73
142
EXECUTE sp_configure 'allow server scoped db credentials', 1;
@@ -86,32 +155,38 @@ WITH (
86
155
87
156
## Errors and solutions
88
157
89
-
[!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] enabled by Azure Arc fails to authenticate using Managed Identity.
158
+
### External table isn't accessible (Error 16562)
90
159
91
-
To use managed identity, [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] must be enabled by Azure Arc. For instructions on how to enable by Azure Arc, review [Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md).
92
-
93
-
Enable `sp_configure 'allow server scoped db credentials'`.
94
-
95
-
If any of the following are true, the PolyBase query fails:
96
-
97
-
- The SQL Server instance isn't properly configured for Azure Arc
98
-
- Registry entries are missing
99
-
-`allow server scoped db credentials` is disabled
100
-
101
-
The query will return one of the following errors when trying to access Azure Blob Storage or Azure Data Lake:
160
+
You might encounter error 16562 when trying to access Azure Blob Storage or Azure Data Lake if you're missing prerequisites:
102
161
103
162
```output
104
163
Msg 16562, Level 16, State 1, Line 79
105
164
External table <name> is not accessible because location does not exist or it is used by another process.
106
165
```
107
166
108
-
Or
167
+
Check the following items:
168
+
169
+
- The SQL Server instance is properly configured for Azure Arc. For more information, see [Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md).
170
+
171
+
- The required registry entries exist.
172
+
173
+
-`allow server scoped db credentials` is enabled.
174
+
175
+
### File can't be opened (Error 16562)
176
+
177
+
You might encounter error 13822 when you access Azure Blob Storage or Azure Data Lake if the managed identity lacks permissions on the storage account, or network access to storage is blocked.
109
178
110
179
```output
111
-
Msg 16562, Level 16, State 1, Line 79
112
-
External table <name> is not accessible because location does not exist or it is used by another process.
180
+
Msg 13822, Level 16, State 1, Line 9
181
+
File <file> cannot be opened because it does not exist or it is used by another process.
113
182
```
114
183
184
+
Check the following items:
185
+
186
+
- Does the managed identity have permissions to the storage container?
187
+
- Can the managed identity access the storage container outside SQL Server?
188
+
- Is the file locked exclusively?
189
+
115
190
## Related content
116
191
117
192
-[Managed identity (preview) for SQL Server enabled by Azure Arc](../../sql-server/azure-arc/managed-identity.md)
0 commit comments