Microsoft Entra ID application

Create a Microsoft Entra ID (formerly Azure Active Directory) application to authenticate DCT with Azure. This application is used for discovery and lightweight operational API calls.

The Entra ID application requires the following API permissions:

  • Permission to list Azure SQL Managed Instances and databases.

    • Permission to restore a database.

  • Permission to list Storage Accounts and containers.

  • Permission to write to the designated Storage Account.

Azure Blob Storage Account

A dedicated Azure Blob Storage Account with at least one container must be created and available in the same region as the Managed Instances. This storage account enables:

  • Backup storage for DCT-initiated snapshots.

  • Backup sharing across accounts within the same region.

The Azure Blob Storage Account must be in the same region as the SQL Managed Instances it supports.

Azure SQL Managed Instance access

Unlike AWS RDS, CD4P communicates directly with Azure SQL Managed Instance databases to perform operations including provision, refresh, and snapshot. Database-level authentication must therefore be configured as part of the Cloud Account setup process. One of the following authentication methods can be specified:

  • SQL Server username and password: Simpler to configure. Requires a SQL login with db_owner or equivalent permissions on the target databases.

  • Microsoft Entra ID authentication: More secure. Requires additional Entra ID configuration. Recommended for production environments.

Azure SQL Managed Instances require network connectivity between DCT and the managed instance over JDBC for operations including snapshot and provision from snapshot. Both public and private endpoints are supported. If using a private endpoint, you must configure network connectivity between DCT and the managed instance — for example, via Azure Virtual Network peering or Azure Private Link. See Azure SQL Managed Instance private endpoint overview for configuration guidance.

SQL Managed Instance requirements summary

The following resources must be created and available before configuring a Cloud Account for Azure SQL MI:

  • One or more Azure SQL Managed Instances in the same availability zone (e.g., East US).

  • A Microsoft Entra ID Application with the required API permissions.

  • An Azure Blob Storage Account with a container in the same region.

  • SQL Server or Entra ID credentials for database-level access.

Architecture

The recommended architecture for Azure SQL MI deployments:

  • Production Managed Instance: Contains the source databases (Root Sources). DCT discovers and orchestrates the golden copy provisioning.

  • Neutral Zone: DCT is deployed here with HTTPS access to both production and non-production Azure subscriptions.

  • Production Zone: Continuous Compliance engine is deployed here with JDBC access to the production SQL MI databases.

  • Non-Production Managed Instance: Contains provisioned development and testing databases. Must be in the same region as the production instance.

  • Shared Storage Account: Azure Blob Storage used for backup sharing between production and non-production accounts within the region.

For Kubernetes deployments, the CD4P plugin containers (aws-rds-plugin and azure-paas-plugin) are commented out in the default Helm configuration. They must be explicitly uncommented and enabled before CD4P features become available. Appliance-based deployments have the plugins enabled by default.

Last updated
Oct 8, 2026