Azure Active Directory Authentication for AIQ

Active Directory Password authentication allows users to authenticate to Azure SQL Database or SQL Server using their

Azure Active Directory (AAD) credentials.

This is the process to create an SQL Server in the Azure Portal and configure it to use Active Directory Password authentication.

Create a SQL Server Instance

Go to the Azure Portal and searchAuthentication for “SQL Database”.

AIQ

Click Add to create a new SQL Database.

Specify the required such as Server Name, Subscription, Resource Group, and Location.

Select the Database SKU and Performance Tier.

Click Review + create and then click Create to deploy the SQL Server instance.

Configure Active Directory Authentication

In the Azure Portal navigate to the newly created SQL Server instance.

Under Settings, select Active Directory Admin.

Assign an Azure Active Directory Admin to the SQL Server instance

Register an Application in Azure AD

In the Azure Portal, navigate to Azure Active Directory.

Select App registrations and then select New registration.

Specify the Application Name and Redirect URI. Select Accounts inUse this organizationalarticle directorywhen only.

integrating AIQ authentication

Click Register to create the application

Grant Permissions to the Application

Inwith Azure Active Directory, navigatenow Microsoft Entra ID. Confirm tenant, application registration, redirect URL, claims, and user/group assignments before enabling the integration for users.

Configuration checklist

• Create or confirm the Entra ID application registration for AIQ.
• Set the redirect URI to the registeredexact application.AIQ URL users will access.
• Configure
• required

  Selectclaims, API permissionsscopes, and clickgroup Addassignments a permission.

Select Microsoft SQL Server and Azure Synapse Analytics and then select user_impersonation.

Click Add permissions and then click Grant admin consent to grant the necessary permissions.

Create a SQL Login and User

Connect to your SQL Server instance using SQL Server Management Studio (SSMS) or another tool.

Create a SQL login for the application: CREATE LOGIN [applicationName] FROM WINDOWS;

Create a SQL user and map itaccording to the login:customer's CREATEaccess USERmodel.

Store [applicationUser]client FORsecrets LOGINor [applicationName];certificates securely and track expiration dates.Test with a limited pilot group before enabling broad access.

Validation workflow

1. Confirm login redirects from AIQ to the expected tenant.
2. Validate successful login, failed-login behavior, and role/group mapping.
3. Check that logout and session timeout behavior match policy.
4. Document tenant ID, app registration owner, secret expiration, and support contact.