Book_08 — The Application Chain: LDAP-Bound and SQL-Consuming Applications

Following the Transformation Upstream Into the Middleware Layer

SQL Server does not exist in isolation — it is downstream of applications, many of them LDAP-bound. Applies the LDAP-dependent-application migration plan’s four-class migration taxonomy (App Proxy, SAML, OIDC, Entra Domain Services) specifically to SQL-consuming applications, traces the authentication chain from the user’s Entra credential through the application to the SQL connection, and describes the connection-string migration as the last mile.
Note

An upstream application that has migrated its user authentication to Entra ID but still uses a SQL Authentication service account to reach the database has not completed its transformation. The application chain must be addressed as a complete authentication path, not as independent layers.

User to middleware application to SQL Server: track 1, user sign-in, moves from LDAP bind to OIDC or SAML with Entra ID; track 2, the database connection, moves from a SQL login or Integrated Security to a managed identity or service principal.

The application chain has two authentication tracks, and both must leave Active Directory.
TipDownload this book

Book_08-bundle.docx — every chapter of this book concatenated into one Word document. Regenerated on every site deploy.

Chapters

Place in the dependency chain: Step 6 — Move applications.

Authoritative references

Checked 19 October 2026.

TipContinue the series

← Previous: Book 07 — Access Control · Index · Next: Book 09 — The Transformed Posture →

Back to top