What tenantid is taken when we use authentication=ActiveDirectoryServicePrincipal in connection string with clientId and secret

Question

Hi Team,

What tenantid is taken when we use authentication=ActiveDirectoryServicePrincipal in sql connection string?

Answer 1

@VD That functionality is not built into Microsoft.Data.SqlClient today.
But I get your point and see that it would be a useful feature to have. I would request you to create a feature request here

Regarding acquiring access token using ClientSecret or AuthenticationContext, specifying the TenantId is optional in case of single tenant application.
This is because the SDK can determine the service principal (highlighted in Green) and tenant based on the clientId (highlighted in blue) you provide.

You can check this relationship from the Azure portal on the Overview blade of your AD Application.

Do let me know if you have further questions.

----------

If an answer is helpful, please "Accept answer" or "Up-Vote" for the same which might be beneficial to other community members reading this thread.

Answer 2

@VD Thank you for reaching out.
By default, web app/API registrations in Azure AD are single tenant. So, you don't have to pass the tenant id to acquire the access token.

If you have a multi-tenant application, you can pass the tenant id while acquiring the access token.
Code below is from the constructor of DbContext in an EF Core application

public MSXDataContext(DbContextOptions<MSXDataContext> options) : base(options)  
{  
    var connection = (SqlConnection)Database.GetDbConnection();  
    connection.AccessToken = new Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider()  
                                .GetAccessTokenAsync("https://database.windows.net/", tenantId: "YOUR-TENANT-ID Here").Result;  
}  

Please let us know if you have further questions.

----------

If an answer is helpful, please "Accept answer" or "Up-Vote" for the same which might be beneficial to other community members reading this thread.