Unable to connect to SQL 2022 instance with Entra MFA after successfully implementing Entra MFA on Azure ARC

Hi Lalitha,

If the Microsoft Entra admin is not showing under SQL Server logins and the FederatedAuthentication registry key is not present, I would first confirm whether the Azure Arc configuration actually completed on the SQL Server host.

For SQL Server 2022 enabled by Azure Arc, the Entra authentication setup is pushed by the Azure Arc agent/SQL extension after you save the Entra admin configuration in the Azure portal. It can take a few minutes. If the Arc agent did not complete the operation, Entra MFA login will not work even though the portal-side setup looks partly configured.

Please check these items:

1. In Azure portal, open the SQL Server - Azure Arc resource and verify the resource is Connected.

Go to Microsoft Entra ID and Purview on the Arc SQL resource and confirm the Entra admin configuration shows as saved successfully.

Make sure the Azure Extension for SQL Server is installed and healthy on the Arc-enabled server.

Restart the SQL Server instance after the Entra admin setup completes. Microsoft documentation notes that the new Entra admin may not appear in sys.server_principals until SQL Server is restarted.

Query the Entra logins from master:

SELECT name, type_desc
FROM sys.server_principals
WHERE type IN ('E', 'X');

When testing from SSMS, use a supported Entra authentication method such as Microsoft Entra MFA / Universal with MFA, and set the target database explicitly under Options > Connection Properties > Connect to database.

Make sure the connection is encrypted. If the SQL Server certificate is not trusted by the client, either configure a trusted TLS certificate or select Trust server certificate for testing.

I would not manually create or edit the FederatedAuthentication registry key unless you are following the non-Arc setup path or Microsoft Support specifically asks you to. For Azure Arc-enabled SQL Server, those settings should be configured by the Arc agent/SQL extension.

If the registry key is still missing after the Arc SQL resource shows connected, the SQL extension is healthy, and the Entra admin save completed, collect the Arc agent/SQL extension logs and open a Microsoft support case. This likely means the Entra authentication configuration did not finish on the SQL host.

When testing from SSMS, use a supported Entra authentication method such as Microsoft Entra MFA / Universal with MFA, and set the target database explicitly under Options > Connection Properties > Connect to database.

That would be kind of difficult for Lalitha since Entra is authentication isn't working... Anyway, to run that simple query there is no need to be connected through Entra, but plain Windows or SQL authentication works.

Oh, by the way, Lalitha, can you share the output from SELECT @@version?

Hi @Lalitha Kothuru ,

This scenario appears to be for SQL Server 2022 enabled by Azure Arc rather than Azure SQL Database.

For SQL Server 2022, Microsoft Entra authentication uses the App Registration and certificate-based setup. If the Entra admin is not appearing under SQL logins and the Federated Authentication registry entries are missing, the next checks should be around the Arc SQL extension configuration and the App Registration/Key Vault prerequisites.

Please verify the following:

• Confirm the App Registration used for SQL Server has the required permissions and that the intended certificate is uploaded to the App Registration.
• Confirm the Key Vault that stores the certificate allows the Azure Connected Machine managed identity to read the certificate. If the Key Vault uses RBAC, verify the managed identity has the required Key Vault certificate/secret reader roles.

On the SQL Server machine, check the latest extension settings file under:

 C:\Packages\Plugins\Microsoft.AzureData.WindowsAgent.SqlServer\<version>\RuntimeSettings

• Confirm the AzureAD settings exist and match the SQL instance, tenant, Entra admin, certificate, Key Vault, and App Registration that you configured.
• After correcting the configuration, restart the SQL Server service once and check whether the Entra admin appears in:

SELECT name, type_desc FROM sys.server_principals;

Use SSMS 19 or later. First test with Microsoft Entra password authentication to confirm the base Arc/SQL Entra configuration works. If that works but Universal with MFA fails, then check the MFA/Conditional Access policy path.

If the registry keys are still not created after the App Registration, Key Vault permissions, RuntimeSettings, and SQL service restart are validated, please share the exact error shown in SSMS and the relevant redacted SQL extension/deployer log entries. Avoid posting tenant IDs, subscription IDs, secrets, certificates, or full connection strings publicly.

Hi @Lalitha Kothuru ,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.