Search code examples
azure-active-directoryazure-sql-databasemicrosoft-entra-id

Rename security group in EntraID and mapped Azure SQL logins and users


I have pretty much the same problem as this question, except for EntraID and Azure SQL Server: Rename security group in AD, and mapped SQL login

Essentially I created an EntraID group - let's say "sql-users". Created the Login from External Provider at the Server level and then created users from login at the database level for certain databases. I had no issue creating the login and having users login to the databases with their EntraID logins.

I then later wanted to rename the EntraID Security group to let's say "sql-readonly-users".

After doing so, in sys.server_prinicipals, I still see "sql-users".

How can I update the server_principal name to reflect the EntraID group's name?

If I try to run CREATE LOGIN [sql-readonly-users] FROM EXTERNAL PROVIDER, I receive the following error that the server principal already exists:

Msg 15025, Level 16, State 8, Line 1
The server principal 'sql-users' already exists.

If I try ALTER LOGIN [sql-users] WITH NAME = [sql-readonly-users], I receive the following error:

Msg 40597, Level 16, State 1, Line 14
Keyword or statement option 'WITH_NAME_OR_PASSWORD' is not supported for External Logins.

The only other thing noted in the other question is to reboot the server which is not possible in Azure SQL.


Solution

  • In case of Azure SQL database with AD auth enabled, The login or meta data continues to preserve the original name of the group which was used during the user initial creation. Even if the AD group or Service principal is renamed in Entra ID, in the database it would continue to remain as the original aspect but there wont be any downstream impact.

    The only was would be to drop that login and recreate it with the latest name if need be