Search code examples
azureazure-active-directoryazure-postgresql

Can't add Azure AD Admins to Azure Database for PostgreSQL flexible server with Private access (VNet Integration)

I have created in my Azure subscription two instances of Azure Database for PostgreSQL flexible server.Let me call them server01-psql and server02-psql They both

  • are in the same Resource group, let me call it app-rg
  • run POstgreSQL version 14
  • are created with Authentication method: PostgreSQL and Azure Active Directory authentication

The difference is only

  • server01-psql | Networking > Connectivity method: Private access (VNet Integration) to a VNet and Subnet from the same Azure subscription
  • server02-psql | Networking > Connectivity method: Public access (allowed IP addresses)

I want to add chosen Azure AD group, let me call it all-app-dbadm, as Azure Active Directory Administrators (Azure AD Admins) for both instances of Azure Database for PostgreSQL flexible server.

My account is Owner of the subscription and my account is also Global Administrator of the related Azure Active Directory.

I can successfully add group from related Tenant to server02-psql in section Authentication > Azure Active Directory Administrators (Azure AD Admins)

However if I try to use

  • portal.azure.com Azure AD Admins in portal.azure.com
  • or az-cli az postgres flexible-server ad-admin create -g app-rg -s server01-psql -u mysupergroup -i mysupergroupguid -t Group I allways get an error. Deployment to resource group 'app-rg' failed. Additional details from the underlying API that might be helpful: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details. The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'. (Code: ResourceDeploymentFailure, Target: /subscriptions/mysupersubscriptionid/resourceGroups/app-rg/providers/Microsoft.Resources/deployments/addAdmins-0-XXXXXX)

Could you recommend what needs to be changed on any of the related resources, or perhaps at the subscription level, or in the process of the change to add successfully Azure Active Directory Administrators (Azure AD Admins) to server01-psql?

Solution

  • I encountered the same error while setting the AD group as the AD admin in the Azure database for PostgreSQL flexible server, as mentioned below:

    enter image description here

    To resolve the issue, I added an outbound network security group (NSG) rule to allow virtual network traffic to only reach the AzureActiveDirectory service tag, as mentioned below:

    enter image description here

    enter image description here

    I attempted to set the admin using the following command in Azure CLI:

    az postgres flexible-server ad-admin create -g <resourceGroupName> -s <serverName> -u <AD Group> -i <AD groupId> -t Group

    It executed successfully without any errors, as mentioned below:

    enter image description here

    The admin was added successfully to the server, as mentioned below:

    enter image description here

    For more information, you can refer to this.