mgmt, sql , fix live test failures by v-huizhu2 · Pull Request #49163 · Azure/azure-sdk-for-java

v-huizhu2 · 2026-05-13T02:00:48Z

Introduces a method to enable Microsoft Entra-only authentication when creating SQL Servers, addressing scenarios where policies require disabling SQL authentication. Updates tests and utilities to use Entra admin exclusively, improving compliance with platform security requirements.

Description

#49070

If an SDK is being regenerated based on a new swagger spec, a link to the pull request containing these swagger spec changes has been included above.

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

Introduces a method to enable Microsoft Entra-only authentication when creating SQL Servers, addressing scenarios where policies require disabling SQL authentication. Updates tests and utilities to use Entra admin exclusively, improving compliance with platform security requirements.

XiaofeiCao · 2026-05-13T05:46:42Z

For general region, we could make it a field property and reference it in each test, in case we need to update it again in future recording tests.

Region as field property — Done. Extracted DEFAULT_REGION, SECONDARY_REGION, TERTIARY_REGION as private static final constants at class level.

XiaofeiCao · 2026-05-13T05:47:32Z

What's the accountKey if SAS is disabled?

What's the accountKey if SAS is disabled? — That's exactly why the threat detection policy test is now commented out. The AAD-only tenant requires disableSharedKeyAccess(), which makes getKeys() return keys the data plane won't accept. The securityAlertPolicies API has no Managed Identity option (unlike auditingSettings), so there's no working auth path. The import/export test was rewritten to use withManagedIdentity(uamiResourceId) instead.

XiaofeiCao · 2026-05-13T05:51:00Z

These seems not needed?

These seems not needed?" (adminLogin/adminSid in SqlServerTest) — Correct, removed. Each test now calls azureCliSignedInUser() directly to get the AzureUser, making the adminLogin()/adminSid() helpers and their caching logic unnecessary.

XiaofeiCao · 2026-05-13T05:52:55Z

Is this due to concurrent test running? If so, we could enhance the azureCliSignedInUser method, to cache the AzureUser instance.

"Is this due to concurrent test running? Cache azureCliSignedInUser?" — The azureCliSignedInUser() method is inherited from ResourceManagerTestProxyTestBase. Each test method calls it independently; tests don't run concurrently within a single class (JUnit 5 default). If caching is desired for performance, it can be done in the base class. Current usage is simple and correct without caching.

Enables user-assigned managed identity authentication for SQL database import/export operations, allowing secure access to storage accounts when shared-key authentication is disabled. Updates public APIs, implementation, and tests to support this authentication method. Also refines Entra-only authentication setup, streamlining interface and test usage. Relates to customer scenarios with storage accounts enforcing identity-based access.

Cleans up formatting by deleting a redundant empty line, improving code readability and maintaining style consistency.

Removes unnecessary line breaks and indentation in several interface method and type declarations to improve code readability and maintain consistency across model definitions.

Allows user-assigned managed identity authentication for SQL database import, export, and creation stages in the fluent API, clarifying that these enhancements impact only SDK-implemented interfaces and do not break user implementations.

…ity support and update dependencies

… pom.xml

…administrator configuration

Copilot

Pull request overview

Adds support for creating Azure SQL Servers with Microsoft Entra-only authentication and for using user-assigned managed identities (UAMI) in database import/export, so live tests can comply with policies that disallow SQL admin login/password. Existing live tests are migrated to use the signed-in Entra user (or a UAMI) instead of withAdministratorLogin/withAdministratorPassword, and a few unrelated quota/region tweaks make the tests less flaky.

Changes:

New SqlServer definition surface: withAzureActiveDirectoryOnlyAuthentication, withExternalActiveDirectoryAdministrator, isAzureActiveDirectoryOnlyAuthenticationEnabled, and withPrimaryUserAssignedManagedServiceIdentity; Definition chain rewired so AAD-only auth is reachable from WithAdministratorLogin.
New AuthenticationType.MANAGED_IDENTITY plus withManagedIdentity on SqlDatabaseImportRequest, SqlDatabaseExportRequest, and the import flow on SqlDatabase/SqlDatabaseOperations, with storage MI also propagated in export and new-database import helpers; storage helpers no longer overwrite an MI-based storage key when the account has shared key access disabled.
Tests migrated to Entra-only auth (using azureCliSignedInUser() and a UAMI), with new MSI/Authorization test dependencies, region constants, smaller SKUs, and a more robust replication failover wait; the legacy threat-detection test is disabled.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlServer.java	Adds new AAD-only/external admin/UAMI stages and rewires the `Definition` chain.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/implementation/SqlServerImpl.java	Implements AAD-only auth, external Entra admin, primary UAMI, and `isAzureActiveDirectoryOnlyAuthenticationEnabled`.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/AuthenticationType.java	Adds `MANAGED_IDENTITY` enum value.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlDatabaseImportRequest.java	Adds default `withManagedIdentity` stage method.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlDatabaseExportRequest.java	Adds default `withManagedIdentity` stage method.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlDatabaseOperations.java	Adds `withManagedIdentity` on new-database import auth stages.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlDatabase.java	Adds `withManagedIdentity` on nested database-in-server import auth stages.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/implementation/SqlDatabaseImpl.java	Implements MI-based import auth and avoids overwriting MI storage key when shared key access is disabled.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/implementation/SqlDatabaseForElasticPoolImpl.java	Delegates `withManagedIdentity` to the underlying `SqlDatabaseImpl`.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/implementation/SqlDatabaseImportRequestImpl.java	Implements MI-based SQL auth for existing-database import.
sdk/sql/azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/implementation/SqlDatabaseExportRequestImpl.java	Implements MI-based SQL+storage auth for export, with shared-key guard.
sdk/sql/azure-resourcemanager-sql/src/test/java/com/azure/resourcemanager/sql/SqlServerTest.java	Wires `MsiManager` and `AuthorizationManager` for tests.
sdk/sql/azure-resourcemanager-sql/src/test/java/com/azure/resourcemanager/sql/SqlServerOperationsTests.java	Migrates tests to Entra auth/UAMI, centralizes regions, tweaks SKUs, hardens replication wait, disables legacy ATP test.
sdk/sql/azure-resourcemanager-sql/pom.xml	Adds test-scope MSI/Authorization deps and `--add-reads` for the test module.
sdk/sql/azure-resourcemanager-sql/CHANGELOG.md	Documents the new AAD-only and managed-identity features.
sdk/sql/azure-resourcemanager-sql/assets.json	Updates the recorded test assets tag.

weidongxu-microsoft · 2026-06-02T07:12:36Z

+            .withAzureActiveDirectoryOnlyAuthentication()
+            .withExternalActiveDirectoryAdministrator(user.userPrincipalName(), user.id(), PrincipalType.USER)


agent reminds me that we still use the name/pass for database in tests
https://github.com/v-huizhu2/azure-sdk-for-java/blob/aa51b4834956dc215d30a410d49b9cdc643e4241/sdk/sql/azure-resourcemanager-sql/src/test/java/com/azure/resourcemanager/sql/SqlServerOperationsTests.java#L134-L135

We may need to add a comment to the test, that the real sql data sync require name/pass.

https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-data-sync-data-sql-server-sql-database?view=azuresql

SQL Data Sync requires SQL authentication for connections to the hub and member databases. Microsoft Entra (Azure AD) authentication isn't supported by SQL Data Sync. Because SQL authentication relies on static passwords, it doesn't benefit from modern protections like multifactor authentication (MFA), Conditional Access, or managed identities. This can increase exposure for the entire SQL instance to credential theft, brute‑force attacks, and operational overhead for password rotation and policy enforcement. Where possible, prefer solutions that support Microsoft Entra authentication or managed identities. Since SQL Data Sync is scheduled for retirement, migrate to an alternative that aligns with your organization's security standards.

I see. Seems SQL Data Sync will be retired in 2027, logged issue to deprecate and replace: #49343

Got it. I wasn't aware that they are deprecating.

weidongxu-microsoft · 2026-06-02T07:18:21Z

    }

+    @Override
+    public SqlDatabaseImportRequestImpl withManagedIdentity(String managedIdentityResourceId) {


agent seems correct:

storage side → storageKeyType(MANAGED_IDENTITY) and storageKey(managedIdentityResourceId)

Yeah, missed this one. Seems this method doesn't have any test cases for it (exports in ExportRequest, and import in SqlDatabase interface). Let me ask agent to add one.

Done. Also did a simple fix for a potential bug with sami and uami setting order. We didn't expose MI update, so I didn't include the whole logic.

github-actions Bot added the Mgmt This issue is related to a management-plane library. label May 13, 2026

weidongxu-microsoft reviewed May 13, 2026

View reviewed changes

Comment thread .../azure-resourcemanager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlServer.java Outdated

XiaofeiCao reviewed May 13, 2026

View reviewed changes

v-huizhu2 added 5 commits May 15, 2026 21:32

Removes unnecessary blank line from test class

56426fd

Cleans up formatting by deleting a redundant empty line, improving code readability and maintaining style consistency.

Simplifies interface declarations for readability

b3d54a6

Removes unnecessary line breaks and indentation in several interface method and type declarations to improve code readability and maintain consistency across model definitions.

Merge branch 'main' into java_mgmt_sql

a2b6367

weidongxu-microsoft reviewed May 18, 2026

View reviewed changes

Comment thread eng/lintingconfigs/revapi/track2/revapi.json Outdated

XiaofeiCao reviewed May 18, 2026

View reviewed changes

Comment thread ...manager-sql/src/main/java/com/azure/resourcemanager/sql/models/SqlDatabaseExportRequest.java Outdated

XiaofeiCao reviewed May 18, 2026

View reviewed changes

Comment thread ...esourcemanager-sql/src/test/java/com/azure/resourcemanager/sql/SqlServerOperationsTests.java Outdated

v-huizhu2 and others added 4 commits May 24, 2026 19:08

Enhance SQL Database and Server APIs with user-assigned managed ident…

769d1f0

…ity support and update dependencies

Add module read permissions for authorization and managed identity in…

c0bd694

… pom.xml

Add support for explicit principal type in external Active Directory …

24958d0

…administrator configuration

fix import/export

ca8fabd

XiaofeiCao marked this pull request as ready for review May 29, 2026 11:35

Copilot AI review requested due to automatic review settings May 29, 2026 11:35

XiaofeiCao requested review from a team, ArthurMa1978 and haolingdong-msft as code owners May 29, 2026 11:35

Copilot started reviewing on behalf of XiaofeiCao May 29, 2026 11:35 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

XiaofeiCao added 2 commits June 1, 2026 13:31

minor fix, recording

2b82ab3

imports

aa51b48

weidongxu-microsoft reviewed Jun 2, 2026

View reviewed changes

XiaofeiCao mentioned this pull request Jun 2, 2026

[mgmt sql] Deprecate SqlSyncGroup / SqlSyncMember in azure-resourcemanager-sql (SQL Data Sync retirement) #49343

Open

XiaofeiCao added 2 commits June 2, 2026 17:30

address comments

67fd6e0

record

82c846a

		.withAzureActiveDirectoryOnlyAuthentication()
		.withExternalActiveDirectoryAdministrator(user.userPrincipalName(), user.id(), PrincipalType.USER)

Conversation

v-huizhu2 commented May 13, 2026

Description

All SDK Contribution checklist:

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants