Applicability — Where the Series Applies as Written

Cloud environment, SQL Server version, platform and topology limits, with alternatives and fallback protections

Read this before Book 01. The series applies as written to SQL Server 2022 and 2025 on Windows, standalone or in availability groups, connected to Microsoft’s commercial cloud (including GCC-Moderate). It does not apply as written to GCC High or DoD, air-gapped networks, failover cluster instances, SQL Server 2019 and older, or most Linux deployments. Platform facts are stamped as of 19 October 2026.
ImportantPlatform facts as of 19 October 2026

SQL Server enabled by Azure Arc changes month to month.1 Every platform fact on this page was checked against Microsoft Learn on 19 October 2026. Recheck the linked pages before you rely on them.

TipDownload this page

Applicability-bundle.docx — this page as one Word document. Regenerated on every site deploy.

Where the series applies as written

The engine-side steps (Books 04, 05 and 09) depend on Microsoft Entra authentication in SQL Server itself. The series applies as written where all of these hold:

Dimension In scope Source
Cloud Microsoft’s commercial cloud, including GCC-Moderate tenants. SQL Server needs access to the Azure public cloud to use Entra authentication. 2
SQL Server version SQL Server 2022 (app registration and Key Vault certificate) and SQL Server 2025 (Arc managed identity, recommended for 2025). 3 4
Operating system Windows. The managed-identity setup is supported only for Arc-enabled SQL Server 2025 on Windows Server. 5
Topology Standalone instances and availability groups. 6

Where it does not apply as written

Environment What Microsoft documents What still applies
GCC High and DoD (Azure Government) SQL Server enabled by Azure Arc in Azure Government runs only in US Gov Virginia, only on Windows, and offers only onboarding, inventory, licensing and billing, failover-cluster-instance management and ESU licenses; “all other features are not currently available.” Entra authentication is not among them.7 Microsoft Cloud PKI is supported in GCC High but not DoD.8 Books 01–03 (case, consolidation, audit), Book 06 (Kerberos repair and NTLM restriction) and the Entra-side work of Book 07: dynamic groups, PIM, access reviews and entitlement management are available in Azure Government.9 Books 04, 05 and 09 do not apply until the engine side is available there.
Air-gapped or disconnected networks Entra authentication needs outbound reach to Entra ID and Microsoft Graph, with or without Arc.10 Microsoft’s cloud-first identity guidance says disconnected applications need to stay on premises.11 Consolidation (Book 02), the audit (Book 03) and Kerberos hardening (Book 06).
Failover cluster instances (FCIs) Entra authentication is not supported for SQL Server failover cluster instances.12 Arc can still onboard and manage them. Move the databases to an availability group, or keep the FCI on Kerberos with the fallback protections below, tracked as a named exception class.
SQL Server 2019 and older Entra authentication needs SQL Server 2022 or later.13 The upgrade is a prerequisite and belongs to Book 02’s consolidation plan. Until then, Kerberos hardening only.
SQL Server on Linux Entra authentication is documented for SQL Server 2022 on Linux. The managed-identity path and Disable SQL Authentication are Windows-only on SQL Server 2025.14 15 Treat Linux instances as their own exception class and verify each feature on Microsoft Learn before planning.

Alternatives

Entra authentication without Azure Arc. Microsoft documents a manual setup for SQL Server 2022 and later on Windows. You register an application, upload a certificate, install adal.dll from the OLE DB driver, and set the FederatedAuthentication registry values. The host still needs outbound access to login.windows.net, login.microsoftonline.com, graph.microsoft.com, graph.windows.net and database.windows.net.16 It suits agencies that won’t install the Arc agent, but you take on certificate rotation and configuration drift yourself. Microsoft documents only commercial-cloud endpoints for this method, so the series makes no claim that it works in Azure Government.

Re-platforming. For a data domain whose instances fall out of scope, the platform question (Book 11) is a legitimate alternative. The identity question follows the data to any platform.

Fallback protections for out-of-scope servers

An instance that can’t reach Entra authentication still benefits from most of the series:

  • Consolidate first. Retiring the instance removes the problem (Book 02).
  • Turn SQL authentication off where you can. Use Windows Authentication mode (SERVERPROPERTY('IsIntegratedSecurityOnly') = 1), disable and rename sa, and give every remaining SQL login an owner and a sunset date.17
  • Make Kerberos work and measure it. Register SPNs so connections negotiate Kerberos instead of falling back to NTLM, and confirm with sys.dm_exec_connections.auth_scheme (Book 06).18 19
  • Retire the weakest protocols. NTLMv1 is removed in Windows Server 2025, and NTLMv2 and RC4 for Kerberos are deprecated.20 Use the enhanced NTLM auditing events (Windows 11 24H2, Windows Server 2019 and later) to find what still uses NTLM.21
  • Least privilege through AD groups. Apply the one-group, one-role discipline of Book 07 with AD groups and recurring reviews.
  • Third-party MFA for Kerberos and NTLM. Some products add MFA to legacy protocols. Evaluate them as compensating controls, not as a destination.
TipContinue the series

Index · Next: Book 01 — The Inheritance →

Back to top

Footnotes

  1. Microsoft Learn, Release notes — SQL Server enabled by Azure Arc.↩︎

  2. Microsoft Learn, Managed identity for SQL Server enabled by Azure Arc, Limitations (“SQL Server needs access to Azure public cloud”; managed-identity setup “only supported with Azure Arc-enabled SQL Server 2025, running on Windows Server”). Checked 19 October 2026.↩︎

  3. Microsoft Learn, Microsoft Entra authentication for SQL Server (SQL Server 2022 and later; failover cluster instances not supported). Checked 19 October 2026.↩︎

  4. Microsoft Learn, Managed identity for SQL Server enabled by Azure Arc, Limitations (“SQL Server needs access to Azure public cloud”; managed-identity setup “only supported with Azure Arc-enabled SQL Server 2025, running on Windows Server”). Checked 19 October 2026.↩︎

  5. Microsoft Learn, Managed identity for SQL Server enabled by Azure Arc, Limitations (“SQL Server needs access to Azure public cloud”; managed-identity setup “only supported with Azure Arc-enabled SQL Server 2025, running on Windows Server”). Checked 19 October 2026.↩︎

  6. Microsoft Learn, Microsoft Entra authentication for SQL Server (SQL Server 2022 and later; failover cluster instances not supported). Checked 19 October 2026.↩︎

  7. Microsoft Learn, Azure Government — SQL Server enabled by Azure Arc. Checked 19 October 2026.↩︎

  8. Microsoft Learn, Microsoft Intune Government service overview.↩︎

  9. Microsoft Learn, Microsoft Entra feature availability in Azure for US Government.↩︎

  10. Microsoft Learn, Enable Microsoft Entra authentication for SQL Server on Windows without Azure Arc, Prerequisites. Checked 19 October 2026.↩︎

  11. Microsoft Learn, Microsoft Entra cloud-first identity guidance.↩︎

  12. Microsoft Learn, Microsoft Entra authentication for SQL Server (SQL Server 2022 and later; failover cluster instances not supported). Checked 19 October 2026.↩︎

  13. Microsoft Learn, Microsoft Entra authentication for SQL Server (SQL Server 2022 and later; failover cluster instances not supported). Checked 19 October 2026.↩︎

  14. Microsoft Learn, Managed identity for SQL Server enabled by Azure Arc, Limitations (“SQL Server needs access to Azure public cloud”; managed-identity setup “only supported with Azure Arc-enabled SQL Server 2025, running on Windows Server”). Checked 19 October 2026.↩︎

  15. Microsoft Learn, Disable SQL Authentication — SQL Server enabled by Azure Arc.↩︎

  16. Microsoft Learn, Enable Microsoft Entra authentication for SQL Server on Windows without Azure Arc, Prerequisites. Checked 19 October 2026.↩︎

  17. Microsoft Learn, SERVERPROPERTY (Transact-SQL).↩︎

  18. Microsoft Learn, Register a Service Principal Name for Kerberos connections.↩︎

  19. Microsoft Learn, sys.dm_exec_connections (auth_scheme).↩︎

  20. Microsoft Learn, Features removed or no longer developed in Windows Server.↩︎

  21. Microsoft Support, Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions.↩︎