azuredatastudio: Azure AD Guest User Access (B2B) failes to Authenticate
- Azure Data Studio Version: 1.17.1 (MAC OS)
Steps to Reproduce:
Setup:
- Created a guest user in alternate AD Tenant AD.
- Invited the guest user into the primary AD.
- Ensure the Guest user accepted the invitation and configured MFA.
- Created a AD Group in the primary AD tenant called
Guest_Group_Testand added the Guest User. - Ensure AD Integration is on with the Azure SQL Server Azure AD by associating your AD User as owner or a group your a member of.
- Log into SQL Server using your user (not the guest)
- The following TSQL was ran in the SQL Database successfully.
CREATE USER [Guest_Group_Test] FROM EXTERNAL PROVIDER;
EXEC sp_addrolemember 'db_datareader', 'Guest_Group_Test';
- Open Azure Data Studio, make a new connection to the target Azure SQL Server.
- Choose
Azure Active Directory - Universal with MFA Support - Ensure the Account is the Guest user email who was added into the primary tenant via b2b.
- Click Connect
Error’s:
Retrieving the Azure token failed. Please Sign in again.
Login failed for user '<token-identified principal>'.
Note: Tested on SSMS version 18 and the above scenario works with authenticating B2B users provided they are in a AD Group.
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 42 (25 by maintainers)
Going to keep this open until I can confirm the PR at least fixed some of the issues.