Chapter 02 — Why the Inheritance Must End

The three drivers that require replacing SQL Server Windows Authentication (NTLM elimination, zero trust and service-account identity), what is and isn’t externally due in 2027, and why their dependencies set the order of the book.

Chapter 02 — Why the Inheritance Must End

Three drivers, each as well-reasoned as the original design, and their dependency structure.

NoteIn this chapter

The three forces that now require replacing Windows Authentication for SQL Server: the NTLM elimination the program has committed to, with its 2027-04-01 backstop; the zero-trust requirement that puts the Microsoft Entra identity plane in the authentication path; and the service-account credential problem the broader directory modernization creates. What is and isn’t externally due in 2027, and why the drivers’ dependencies dictate the order of the whole book.

Three drivers, NTLM elimination, zero trust and service-account identity, impose an order: assess and consolidate, enable Arc, migrate logins, then eliminate NTLM.
Figure 1: Three drivers end the inheritance, and their dependencies set the order of the book.

The reasons for replacement are as well-reasoned as the original design. NTLM elimination, Conditional Access in the authentication path for all human access, and the end of the domain-joined world aren’t preferences.1 They follow from Microsoft’s deprecation of NTLM, from the transformation inventory, and from OMB M-22-09, the Federal Zero Trust Strategy. M-22-09 requires phishing-resistant MFA for agency staff, contractors and partners, enforced at the application layer rather than the network layer, and at least one device-level signal alongside identity when authorizing access.2 The program operationalizes that in its boundary through Conditional Access and phishing-resistant MFA, mapped to the NIST SP 800-53 controls AC-17 (remote access) and IA-2 (identification and authentication).3

Driver one: the NTLM elimination commitment

The first driver is a decision the program has made and recorded. The Kerberos/NTLM-elimination program, accepted 2026-05-13, commits the program to eliminating NTLM.

The external driver is real but gradual. Microsoft deprecated all versions of NTLM, including LANMAN, NTLMv1 and NTLMv2, in June 2024.4 NTLMv1 is already removed from Windows Server 2025 and Windows 11, version 24H2; NTLMv2 still works there but is deprecated and will be removed from Windows Server in a future release.5 Microsoft’s stated next step is to disable network NTLM by default, not remove it, in the next major release of Windows Server and client. That target is subject to change, and administrators will be able to re-enable NTLM by policy, at least at first. Interim milestones come first: enhanced NTLM auditing, already available on Windows Server 2025 and Windows 11, versions 24H2 and 25H2; IAKerb and the local KDC; and blocking policies. In-market versions of Windows and Windows Server keep supporting NTLM.6 One related change arrives through Windows Update in October 2026: the internal default of the BlockNTLMv1SSO setting moves from Audit to Enforce. It applies to Windows 11 and Windows Server 2025 devices that don’t have Credential Guard enabled and haven’t set the value. It blocks only NTLMv1-derived credentials used for single sign-on, such as MS-CHAPv2 for Wi-Fi, Ethernet and VPN, and doesn’t touch SQL Server’s NTLM traffic.7

Microsoft hasn’t published a calendar date for disabling NTLM by default. The program’s 2027-04-01 backstop is its own planning anchor, set to finish ahead of that step. It isn’t a vendor deadline.

Both NTLM variants are eliminated, on different timelines. NTLMv1 goes first. Hosts older than Windows Server 2025 can still negotiate it, so Phase B blocks it through the “Network security: LAN Manager authentication level” policy (the LmCompatibilityLevel setting) as soon as the Phase A assessment completes, a step the program targeted for 2026-Q3. At the strictest level, domain controllers refuse LM and NTLMv1 responses and accept only NTLMv2.8 Any connection that still needs LM or NTLMv1 then fails before the engine evaluates the login. Chapters 14–15 cover the detail.

NTLMv2 has a firm backstop: on 2027-04-01 the program’s enforcement phase disables NTLM at the LSA layer across the estate. Any SQL Server connection still relying on it, whether through a missing SPN, a client that can’t negotiate Kerberos, a trust boundary or an unjoined host, will fail inside the host’s security subsystem before the engine sees it.9 2027-04-01 isn’t the migration’s completion date. It’s the date by which consolidation, Arc deployment, login migration and connection-string migration must already be complete.

ImportantWhat is actually due in 2027

Nothing in Microsoft’s NTLM roadmap or in M-22-09 falls due on 2027-04-01; that date is the program’s. Three external lifecycle dates in 2027 do bear on the SQL Server estate, and they reinforce the order this book sets:

  • Windows Server 2016 leaves extended support on January 12, 2027.10
  • SQL Server 2014 reaches the end of its third and final Extended Security Update year in July 2027; SQL Server 2016’s first ESU year also ends then.1112
  • SQL Server 2017 leaves extended support on October 12, 2027.13

None of these versions can accept Microsoft Entra logins, which need SQL Server 2022 or later.14 Hosts and engines on them are candidates for the consolidation in Chapters 03–06, not for in-place migration.

Driver two: the zero-trust requirement

Two paths from a DBA workstation: Kerberos or NTLM through a domain controller to SQL Server involves no token request and so no policy decision; an Entra token request passes Conditional Access, and the token is issued only if every check passes.
Figure 2: Conditional Access can evaluate an Entra token request; it never sees a Kerberos or NTLM exchange.

The M-22-09 zero-trust posture for this FedRAMP Moderate boundary can’t be implemented without the Microsoft Entra identity plane in the SQL Server authentication path. Conditional Access brings together signals such as user, location, device state and real-time sign-in risk, and enforces its decision when the sign-in asks for access: block, or grant only after MFA, a compliant device or another control is satisfied.15 Kerberos and NTLM involve no Entra sign-in at all, so a DBA on an unmanaged device, outside named locations or with elevated risk can’t be blocked by policy.

With Microsoft Entra authentication, every token request is evaluated first. Missing MFA, a non-compliant device or elevated risk, such as a sign-in from an anonymous IP address that Microsoft Entra ID Protection flags, means no token or a remediation challenge, and no connection.16 Risk-based policies need Microsoft Entra ID P2.17 The policy has real leverage because the token it controls is the credential SQL Server accepts.

Driver three: the service account credential problem

The transformation inventory removes Active Directory as the authoritative identity source. The AD service accounts and gMSAs that authorize the engine on the network then lose their governance foundation,18 so the engine needs a new identity first. Microsoft’s own cloud-first guidance makes the same point from the other direction: inventory every application that authenticates against AD with Kerberos, NTLM or LDAP before moving its users and groups, because those dependencies break when AD stops being the source.19

On premises, that identity arrives through Azure Arc. SQL Server 2025 uses the Arc server’s managed identity directly. SQL Server 2022 uses an app registration certificate that the Arc agent fetches from Key Vault with that identity.202122 Microsoft also documents an Arc-free, certificate-only app-registration setup for SQL Server 2022 and later.23 Arc is therefore a prerequisite, not an enhancement. It doesn’t change the Windows account the service runs as.

The order follows from these dependencies, preceded by the consolidation decision of Chapters 03–06: assess and consolidate, enable Arc, migrate logins, then eliminate NTLM. That order is the architecture of this book.

NoteWhat this chapter establishes
  1. Three independent drivers end the Windows Authentication inheritance: the Kerberos/NTLM-elimination program and its 2027-04-01 backstop, the M-22-09 zero-trust posture, and the engine’s need for an identity that outlives AD.
  2. 2027-04-01 is the program’s date, not Microsoft’s; Microsoft has set no date for disabling NTLM by default, while several SQL Server and Windows Server lifecycle dates do fall in 2027.
  3. The zero-trust posture works only when the Entra identity plane is in the authentication path.
  4. The drivers’ dependencies set the order of the book: inventory and rationalize, audit, enable the identity substrate, move principals and applications, retire protocols, then demonstrate the posture.
TipContinue the book

← Previous: Chapter 01 — What Windows Authentication Actually Is · Book index · Next: Chapter 03 — The Shape of Twenty Years →

  1. Microsoft Learn, “What is Conditional Access?,” https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview (accessed Oct 20, 2026). Common signals (user, IP location, device, application, real-time and calculated risk) and decisions (block, or grant with MFA, compliant device and other controls).↩︎

  2. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 20, 2026). §III.A, Identity, actions 2 and 3: “MFA must be enforced at the application layer, instead of the network layer”; phishing-resistant MFA required for agency staff, contractors and partners; at least one device-level signal alongside identity information.↩︎

  3. National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, AC-17 Remote Access and IA-2 Identification and Authentication (Organizational Users), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf (accessed Oct 20, 2026). The mapping of the program’s controls to these identifiers is the program’s own.↩︎

  4. Microsoft Learn, “Deprecated features for Windows client,” NTLM entry, https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features (accessed Oct 20, 2026). “All versions of NTLM, including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated”; deprecation announced June 2024.↩︎

  5. Microsoft Learn, “Features removed or no longer developed in Windows Server,” https://learn.microsoft.com/en-us/windows-server/get-started/removed-deprecated-features-windows-server (accessed Oct 20, 2026). Windows Server 2025: NTLMv1 removed; “NTLMv2 will continue to work but will be removed from Windows Server in a future release.”↩︎

  6. Microsoft Windows IT Pro Blog, “Retiring NTLM: Frequently asked questions,” September 9, 2026, https://techcommunity.microsoft.com/blog/windows-itpro-blog/retiring-ntlm-frequently-asked-questions/4550522 (accessed Oct 20, 2026). “Our current target for default disablement is the next major release of Server and Client (subject to change)”; NTLM is being disabled by default, not removed; in-market versions continue to support NTLM; enhanced NTLM auditing on Windows 11 24H2/25H2 and Windows Server 2025.↩︎

  7. Microsoft Support, “Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025” (KB5066470), https://support.microsoft.com/help/5066470 (accessed Oct 20, 2026). Audit mode since the August 2025 updates; Enforce becomes the internal default in October 2026 where the value isn’t set and Credential Guard is disabled; scope is NTLMv1-derived credentials for single sign-on (MS-CHAPv2).↩︎

  8. Microsoft Learn, “How to enable NTLM 2 authentication,” https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enable-ntlm-2-authentication (accessed Oct 20, 2026). LMCompatibilityLevel level 5: domain controllers refuse LM and NTLM responses and accept only NTLMv2.↩︎

  9. Microsoft Learn, “Register a Service Principal Name for Kerberos connections,” https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-ver17 (accessed Oct 20, 2026).↩︎

  10. Microsoft Learn, “Windows Server 2016” (Microsoft Lifecycle), https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016 (accessed Oct 20, 2026). Extended support ends January 12, 2027 (listed as 1/13/2027 6:59:59 AM Pacific).↩︎

  11. Microsoft Learn, “SQL Server 2014” (Microsoft Lifecycle), https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2014 (accessed Oct 20, 2026). Extended support ended July 9, 2024; ESU Year 3 runs to July 2027.↩︎

  12. Microsoft Learn, “SQL Server 2016” (Microsoft Lifecycle), https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016 (accessed Oct 20, 2026). Extended support ended July 14, 2026; ESU Year 1 runs to July 2027, Year 3 to July 2029.↩︎

  13. Microsoft Learn, “SQL Server 2017” (Microsoft Lifecycle), https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2017 (accessed Oct 20, 2026). Extended support ends October 12, 2027 (listed as 10/13/2027 6:59:59 AM Pacific).↩︎

  14. Microsoft Learn, “Microsoft Entra authentication for SQL Server,” https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/azure-ad-authentication-sql-server-overview?view=sql-server-ver17 (accessed Oct 20, 2026). Applies to SQL Server 2022 and later; failover cluster instances aren’t supported.↩︎

  15. Microsoft Learn, “What is Conditional Access?,” https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview (accessed Oct 20, 2026). Common signals (user, IP location, device, application, real-time and calculated risk) and decisions (block, or grant with MFA, compliant device and other controls).↩︎

  16. Microsoft Learn, “What is Microsoft Entra ID Protection?,” https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection (accessed Oct 20, 2026). Detections include anonymous IP address usage; risk feeds Conditional Access.↩︎

  17. Microsoft Learn, “Risk-based access policies,” https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies (accessed Oct 20, 2026). “Microsoft Entra ID P2 is required to use risk-based access policies.”↩︎

  18. Microsoft Learn, “Service accounts” (Active Directory Domain Services), https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-service-accounts (accessed Oct 20, 2026).↩︎

  19. Microsoft Learn, “Microsoft Entra cloud-first identity guidance for IT architects,” https://learn.microsoft.com/en-us/entra/identity/hybrid/guidance-it-architects-source-of-authority (accessed Oct 20, 2026). “Always begin with an application inventory before initiating SOA transfer”; inventory all on-premises apps that use AD for authentication (Kerberos/NTLM or LDAP).↩︎

  20. Microsoft Learn, “Azure Arc-enabled servers overview,” https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview (accessed Oct 20, 2026).↩︎

  21. Microsoft Learn, “Managed identity for SQL Server enabled by Azure Arc,” https://learn.microsoft.com/en-us/sql/sql-server/azure-arc/managed-identity?view=sql-server-ver17 (accessed Oct 20, 2026).↩︎

  22. Microsoft Learn, “Tutorial: Set up Microsoft Entra authentication for SQL Server enabled by Azure Arc,” https://learn.microsoft.com/en-us/sql/sql-server/azure-arc/entra-authentication-setup-tutorial?view=sql-server-ver17 (accessed Oct 20, 2026).↩︎

  23. Microsoft Learn, “Tutorial: Enable Microsoft Entra authentication for SQL Server on Windows without Azure Arc,” https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/microsoft-entra-authentication-sql-server-enable-without-arc?view=sql-server-ver17 (accessed Oct 20, 2026). Applies to SQL Server 2022 and later; certificate, app registration and registry configuration.↩︎

Back to top