Users not able to login to SSMS due to an token identified principal error after enforcing MFA

Question

Error Message:

===================================

Cannot connect to DATABASENAME

===================================

Login failed for user '

Answer 1

Please try the steps provided on this documentation.

Hope it helps.

Answer 2

Thanks for the question.

Login failed for user '<token-identified principal>

This error is usually related to a AAD user that does not have user created on SQL DB or is not the Server Admin

Please find below blog for such errors and mitigation steps.

AAD Auth Error - Login failed for user '<token-identified principal>' - Microsoft Community Hub

Possible mitigation step would be-

create the user in the DB Create contained database users in your database mapped to Azure AD identities

To create an Azure AD-based contained database user (other than the server administrator that owns the database), connect to the database with an Azure AD identity, as a user with at least the ALTER ANY USER permission. Then use the following Transact-SQL syntax:

Documentation

CREATE USER [<Azure_AD_principal_name>] FROM EXTERNAL PROVIDER;

Examples: To create a contained database user representing an Azure AD federated or managed domain user:

CREATE USER [bob@contoso.com] FROM EXTERNAL PROVIDER;

CREATE USER [alice@fabrikam.onmicrosoft.com] FROM EXTERNAL PROVIDER;

Let us know if this helps!