Creating LinkedServer between On-Prem SQL to Azure SQL MI

Question

Santosh 41

Hi,

is it possible to use security option (Be made using the login's current security context )with lnikedserver from on-prem SQL to MI ?

Our MI is enabled for windows auth and we are successfully connect MI in SSMS using windows auth from on-prem client.

when I use this option in linkedserver and try to access linked server with windows auth I get following error.

Login failed for user '<token-identified principal>'. Reason: Could not find a user matching the name provided

Erland Sommarskog 119.3K Reputation points MVP

2025-03-10T22:48:04.9566667+00:00

I can't say neither aye no nay to this one, because I don't know. But always in this case, there is a double-hop issue. That is, the on-prem server must be able to pass the security context to the remote server. This requires Kerberos, SPNs and other things I'm not good at.

But start checking in sys.dm_exec_connections that when connecting to the on-prem server that it does says KERBEROS and not NTLM.
Santosh 41 Reputation points

2025-03-11T12:29:11.12+00:00

SPN is already set for on-prem and connection is KERBEROS. I am even able to connect MI using windows auth from on-prem . the only issue when I create linked server form on-prem to MI

Your answer

Erland Sommarskog 119.3K Reputation points MVP

2025-03-10T22:48:04.9566667+00:00

I can't say neither aye no nay to this one, because I don't know. But always in this case, there is a double-hop issue. That is, the on-prem server must be able to pass the security context to the remote server. This requires Kerberos, SPNs and other things I'm not good at.

But start checking in sys.dm_exec_connections that when connecting to the on-prem server that it does says KERBEROS and not NTLM.
Santosh 41 Reputation points

2025-03-11T12:29:11.12+00:00

SPN is already set for on-prem and connection is KERBEROS. I am even able to connect MI using windows auth from on-prem . the only issue when I create linked server form on-prem to MI