Book_04 — Arc as the Identity Bridge

How the Azure Connected Machine Agent Gives the SQL Server Engine a Cloud-Native Identity

Arc is not an end state — it is the bridge. Before a SQL Server instance can accept Entra ID-issued tokens, the host must have a cloud-native identity, and that identity comes from the Azure Connected Machine agent. Describes what Arc provides (the ARM resource identity, the system-assigned managed identity, and the instance’s Entra identity — an app registration with a Key Vault certificate on SQL Server 2022, the managed identity itself on SQL Server 2025), the architecturally-independent two-layer distinction between SQL engine Entra auth and OS-level Entra login, and the Arc deployment sequencing for SQL Server hosts.
Note

Without Arc, the SQL Server engine has no cloud-native identity; without that identity, there is nothing to anchor the instance’s Entra identity — the managed identity on SQL Server 2025, or the app registration certificate the Arc agent installs on SQL Server 2022 — and no mechanism to accept Entra ID-issued tokens.123 This book explains exactly what Arc does and does not change — and why SQL engine Entra auth (Layer 1) must not be blocked on the domain unjoin that OS-level Entra login (Layer 2) requires.

The Connected Machine agent on the on-premises host projects it into Azure Resource Manager; the Azure extension for SQL Server and the instance's Entra identity let the engine validate Entra tokens.

What Azure Arc connects: the on-premises host, Azure Resource Manager and Microsoft Entra ID.
TipDownload this book

Book_04-bundle.docx — every chapter of this book concatenated into one Word document. Regenerated on every site deploy.

Chapters

Place in the dependency chain: Step 4 — Enable identity substrate.

Authoritative references

Checked 19 October 2026.

TipContinue the series

← Previous: Book 03 — Discovery · Index · Next: Book 05 — The Login Migration →

Back to top