We already have an express route configured between azure and our local domain. Local AD is also synced with Azure AD. Azure Function is under a VNet which can access on-premises resources.
The problem is when Azure Function tries to access on-premises SQL using Windows Authentication, it gets the error "Logon Failed" (which proves that the server is accessible but the user doesn't have permission). Event Log shows DWASSVC as the account trying to access DB.
Is there a way we can change the context of Azure Function to run under a specific user which has access to on-Premises SQL DB and any call from Azure Function is generated under that account?
Windows Authentication is not possible on Azure App service platform ( Azure web app, Azure Function).
To access on-prem SQL server, you can use Hybrid connection manager
https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections
Or Put Azure Function in VNET ( ASE) and then make site to site connection.
Related
I have an Azure SQL Database as PaaS Solution. I have some network access rules in the Firewall of Azure SQL Database. I want to connect PowerBI to Azure SQL Database securely. I had checked the option of Allow access to Azure Services in Firewall. However, it also makes the database visible to any component deployed within Azure, such as a virtual machine.
Are there any methods to use Azure SQL Database(Paas) securely from PowerBI?
If you don't want to set Allow access to Azure Services in Azure SQL database firewall, you could add the current client IP address to the firewall.
It will only allow your current client/computer to access the Azure SQL.
Then you could access the Azure SQL database from PowerBI securely.
I have an Azure App Service which already connects to a on-premises SQL Server database (VNet Integration is configured). I also need to access an on-premises fileshare, which is currently not working (access denied). How can this be achieved?
I already tried to use the SimpleImpersonation package (https://www.nuget.org/packages/SimpleImpersonation/), but this was not working. I'm not sure if this was package to work from an Azure App Service.
Thanks in advance.
we have configured azure active directory pass-through authentication . Need to access on premise resources from the azure deployed application. can we do this by configuring application proxy?. so that on premise application authenticated with azure AD. so the communication between azure application and on premise application be seamless. Is it possible?
I'm not entirely sure if I understand you correctly but what you want is probably possible by using Azure Hybrid Connections: https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections
You install the Hybrid Connector on-prem, e.g. on a VM, and then for instance an Azure App Service can access certain resources on-prem.
Or for anything more advanced you might want to look at Azure VPN (or ExpressRoute in the long run).
What is Azure AD connect and Azure ADFS? This is what I have understood: Azure ADFS is exposing on premises AD to Azure cloud and Azure AD connect is means to do that. Am I right?
We need to build an application which needs to authenticate users from different clients' AD. They may or may not have exposed their AD to Azure. Can someone please guide how can this problem be solved?
Azure ADFS is exposing on premises AD to Azure cloud and Azure AD connect is means to do that.
AS of now, the way Azure ADFS works, it essentially provides a way for a company to use AD and ADFS services, without having to deploy themselves. Just like how a Azure has Azure Web App will allow you to have a web server without having your own.
Unfortunately, It does not actually connect or integrate or expose your on premise AD. If you want your clients authenticate against multiple IDs, you do it the old fashioned way, by connecting to the on-premises AD directly. You cannot actually route it through Azure.
One thing which you can do (this will be a huge endeavour) is to move the on premises AD to Azure cloud, which can be done using Azure VMs. Now, that would allow your client to get rid of their on premises AD and use the Azure cloud for everything.
Is there a way to connect from a web app (azure app service) to a SQL Server VM in Azure using Windows authentication? I'm not exactly sure if I need to impersonate or if the app needs to run under the identity that has access to the DB on the SQL Server.
I believe that you can do this - but you will need to share a Active Directory between the two - or have then in a private network together so that they are in the same broadcast subnet.
If you need to use your own Active Directory the create a network and a VPN to your site.
If you don't need to use Active Directory then use SQL Auth.
Looks like it is not possible, although it may be with Azure SQL. But not a VM running MSSQL. Ref links below.
SQL Server Integrated Security from an Azure Web Site
https://azure.microsoft.com/en-us/documentation/articles/sql-database-aad-authentication/