Book_01 — The Authentication Inheritance Problem

Why SQL Server’s Windows Authentication Was Good Engineering, and Why It Must Now End

Names the core tension of the series: SQL Server’s Windows Authentication was the correct answer to the authentication problem of a fully domain-joined world. Describes what that architecture actually is — Kerberos via SSPI, SPN registration, NTLM fallback, service accounts, the sa account — and the three drivers that now require its replacement.

Note

SQL Server’s Windows Authentication was an act of good engineering, not negligence. This book makes the case for replacement without making the case that what came before was foolish — a precise account of what Windows Authentication is, why it worked, and why it must now end.

The four ways a connection authenticates to SQL Server today, and which authority each depends on.

TipDownload this book

Book_01-bundle.docx — every chapter of this book concatenated into one Word document. Regenerated on every site deploy.

Chapters

Place in the dependency chain: Why the chain exists (before step 1).

Authoritative references

Checked 19 October 2026.

• Microsoft Entra authentication for SQL Server overview
• Microsoft Entra cloud-first identity guidance
• Retiring NTLM: frequently asked questions (Microsoft Tech Community)
• OMB M-22-09, Federal Zero Trust Strategy
• Memo 22-09 identity requirements overview

TipContinue the series

← Previous: Applicability · Index · Next: Book 02 — The Estate Itself →