Question

Contoso runs a legacy line-of-business application on a physical Windows server in an on-premises datacenter. The application must connect to an Azure SQL Database. Security requires that no passwords or connection-string secrets be stored on the server, and the solution must avoid deploying or managing certificates manually. What should you recommend to authenticate the application to Azure SQL Database?

Accepted Answer

Install the Azure Connected Machine agent to onboard the server to Azure Arc and use a managed identity for Entra authentication to Azure SQL

Answer

Assign a system-assigned managed identity to the on-premises server and grant it access to the database

Answer

Configure Microsoft Entra ID service principal authentication using a client secret stored in the app config

Answer

Enable SQL Server authentication and store the credentials in a local Windows Credential Manager vault