Setting up a managed identity user on Azure SQL: add a temp firewall rule, then delete it

TL;DR: Then connect as the SQL Entra admin and run CREATE USER [your-app-name] FROM EXTERNAL PROVIDER, plus ALTER ROLE dbdatareader ADD MEMBER and dbdatawriter as needed. do the setup in this order. Get your current IP and create a temporary server firewall rule for it with the Azure CLI: az sql server firewall-rule create with your resource group, server, a name like tmp-mi-setup, and your IP as both start and end.

Fix

1. Then connect as the SQL Entra admin and run CREATE USER [your-app-name] FROM EXTERNAL PROVIDER, plus ALTER ROLE dbdatareader ADD MEMBER and dbdatawriter as needed. Expected: this specific failure stops.

Details

do the setup in this order. Get your current IP and create a temporary server firewall rule for it with the Azure CLI: az sql server firewall-rule create with your resource group, server, a name like tmp-mi-setup, and your IP as both start and end. You can do it without sqlcmd installed using az sql db query with auth-mode ActiveDirectoryDefault. If youre scripting from a CI agent with no interactive login, mint a token yourself with az account get-access-token --resource YOUR_HOST.windows.net/ and connect the mssql driver with azure-active-directory-access-token auth. The moment the user exists, delete the temp rule: az sql server firewall-rule delete. The app itself talks to the database over the Azure backbone, which the firewall allows without any IP rule, so leaving your laptop IP open would just be needless exposure.

When to use

You hit exactly this: Setting up a managed identity user on Azure SQL: add a temp firewall rule, then delete it in Setting.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Setting.