How to fix the identity issue in sql server 2025 AI feature while setting up Vector features

Question

How to fix the identity issue in sql server 2025 AI feature while setting up Vector features

Venugopal, Kamalakkannan 0

I am currently doing POC to explore SQL Server 2025 AI Feature in which I tried to set up Vector features. I am able to create scoped credential and external model but when I do the select statement it gives an error : here is the select state : SELECT AI_GENERATE_EMBEDDINGS(

'SQL Server 2025 embedding test' USE MODEL LogEmbeddingModel

); and query used as : CREATE DATABASE SCOPED CREDENTIAL cred_openai

WITH IDENTITY = 'AzureOpenAI',

SECRET = ''; model query : CREATE EXTERNAL MODEL LogEmbeddingModel

WITH (

LOCATION = 'https://azopencrtsqltst.openai.azure.com/',

API_FORMAT = 'OpenAI',

CREDENTIAL = cred_openai,

MODEL_TYPE = EMBEDDINGS,

MODEL = 'sql-embedding-model',

);

error message : Msg 31628, Level 16, State 1, Line 41

The database scoped credential 'cred_openai' has an invalid identity 'AzureOpenAI' for use with an external rest endpoint.

2 answers

Your answer

Answer 1

Erland Sommarskog 132.4K MVP Volunteer Moderator

I don't do AI myself, but I think you have the location wrong. If you look at https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-model-transact-sql?view=sql-server-ver17#remarks, there is some discussions how the location should look like depending on the service.

There is also discussion about the credential. I see that it must be a URL.

There are also some examples further down that page.

Lakshmi Narayana Garikapati 825 Reputation points Microsoft External Staff Moderator

2026-01-27T10:52:58.9966667+00:00

Hi Venugopal, Kamalakkannan,

I wanted to follow up to check if you had a chance to review the information provided by Erland Sommarskog If you are still facing issues, please don’t hesitate to reach out we’ll be more than happy to assist you.

Best Regards,

Lakshmi.
Venugopal, Kamalakkannan 0 Reputation points

2026-01-29T09:30:43.4033333+00:00
i am still having issues and i used the following
CREATE DATABASE SCOPED CREDENTIAL cred_openai

WITH IDENTITY = 'OpenAI',

SECRET = '';

GO

CREATE EXTERNAL MODEL MyAzureOpenAIModel

AUTHORIZATION dbo

WITH (

LOCATION = 'https://api.openai.com/v1/embeddings/', API_FORMAT = 'OpenAI', MODEL = 'text-embedding-ada-002', MODEL_TYPE = EMBEDDINGS, CREDENTIAL = cred_openai

);

GO

UPDATE ApplicationLogs

SET log_vector = AI_GENERATE_EMBEDDINGS(

LEFT(log_text, 4000) USE MODEL MyAzureOpenAIModel

)
but this is error, am getting it
Msg 31628, Level 16, State 1, Line 19

The database scoped credential 'cred_openai' has an invalid identity 'OpenAI' for use with an external rest endpoint.

The statement has been terminated.

Could you please guide me

WHERE log_vector IS NULL;
Erland Sommarskog 132.4K Reputation points MVP Volunteer Moderator

2026-01-29T21:54:09.89+00:00
So I suggested that you should go to https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-model-transact-sql?view=sql-server-ver17#remarks and also look at the examples below.

But for your convenience I quote the pertinent parts here:

Credential name rules for external model

The created DATABASE SCOPED CREDENTIAL used by an external model must follow these rules:

Must be a valid URL

The URL domain must be one of those domains included in the allow list.

The URL must not contain a query string

Protocol + Fully Qualified Domain Name (FQDN) of the called URL must match Protocol + FQDN of the credential name

Each part of the called URL path must completely match the respective part of the URL path in the credential name.

The credential must point to a path that's more generic than the request URL. For example, a credential created for path https://northwind.azurewebsite.net/customers can't be used for the URL https://northwind.azurewebsite.net.

And here is one example that makes it clear that it is the name of the credential that must be a URL:

CREATE DATABASE SCOPED CREDENTIAL [https://my-azure-openai-endpoint.cognitiveservices.azure.com/] WITH IDENTITY = 'Managed Identity', secret = '{"resourceid":"https://cognitiveservices.azure.com"}'; GO
Venugopal, Kamalakkannan 0 Reputation points

2026-01-30T10:02:21.6233333+00:00
I am able to create Scoped Credential and Model using the given query in link. But When I tried to update Vector log using Model, but it gives a below error. Please see the query and error

Query :
UPDATE ApplicationLogs

SET log_vector = AI_GENERATE_EMBEDDINGS(

LEFT(log_text, 4000) USE MODEL MyAzureOpenAIModel

)

WHERE log_vector IS NULL;

Error:
Msg 37563, Level 16, State 1, Line 18

The primary managed identity is not selected for this SQL Server instance. If the SQL Server instance is in an Azure VM, enable the managed identity of the VM to use Microsoft Entra authentication. For more information, see https://go.microsoft.com/fwlink/?linkid=2323210. If the SQL Server instance is not in an Azure VM, connect it to Azure Arc. For more information, see https://go.microsoft.com/fwlink/?linkid=2323209.

Msg 31636, Level 16, State 1, Line 18

Error retrieving the managed identity access token for the resource id 'https://cognitiveservices.azure.com'. JWTErrorState = 369. 'Entra ID is not enabled on this instance. Please ensure that Entra ID is configured and enabled to proceed.'

The statement has been terminated.

Please help me on this
Erland Sommarskog 132.4K Reputation points MVP Volunteer Moderator

2026-01-30T21:54:54.32+00:00

The example in the link was only to show how the name of the credential should look like. To actually use a Managed Identity, your SQL Server need to be connected to Azure one way or another. That is not likely to be the case, if you are playing on your own.

I don't know exactly what you would put into IDENTITY and SECRET, since I don't work with that AI service, but typically that would be username and password you are using to access the AI service.

If you have accesses this AI service by some other means before, you probably have the information you need.
Lakshmi Narayana Garikapati 825 Reputation points Microsoft External Staff Moderator

2026-02-02T11:59:46.89+00:00

Hi Venugopal, Kamalakkannan,

I'm following up to check whether your issue has been resolved. If you still have any questions or need further assistance, please don't hesitate to reach out we're happy to continue supporting you.

We truly appreciate your participation and thank you for being an active member of the community.

Best regards,

Lakshmi.
Venugopal, Kamalakkannan 0 Reputation points

2026-02-02T12:09:16.2633333+00:00

My issue is still persisting, and I tried in many ways, but the update is not happening what we expect for Vector search and It would be really helpful to need some guidance in order to use the option whether do i need to managed identity or Api Key and need to know location of Azure OpenAI. I am getting the error every time even i changed the parameter in many ways.

Error:
The database scoped credential 'cred_openai' has an invalid identity 'ANONYMOUS' for use with an external rest endpoint.
Note : identity name is only getting change based on the option we i used it.
Kindly help on this
Erland Sommarskog 132.4K Reputation points MVP Volunteer Moderator

2026-02-02T21:36:03.31+00:00

I would recommend that you first try to talk to Azure Open AI outside of SQL Server, so that you are dealing with too many things that are new to you at the same time. Once you have been able to call a REST service to Azure Open AI from PowerShell or C#, it may be clearer to you how do it from SQL Server.

I'm sorry, but I can't give you better guidance, since I don't engage in AI myself.

Answer 2

The error message you are encountering indicates that the identity specified in your database scoped credential (cred_openai) is invalid for use with the external REST endpoint. To resolve this issue, you should check the following:

Identity Value: Ensure that the identity you are using ('AzureOpenAI') is correctly configured and matches the expected format for the Azure OpenAI service. The identity typically should be your actual Azure OpenAI service endpoint or a valid identity that has permissions to access the service.
API Key: Make sure that the SECRET value in your CREATE DATABASE SCOPED CREDENTIAL statement is set correctly. It should contain a valid API key for the Azure OpenAI service. If the API key is empty or incorrect, it can lead to authentication failures.
Service Configuration: Verify that the Azure OpenAI service is properly configured to accept requests from your SQL Server instance. This includes ensuring that any necessary permissions or roles are assigned to the identity you are using.
Testing the Credential: You can also test the credential setup by querying the external model with a simpler query to ensure that the connection to the external REST endpoint is functioning as expected.

If you have confirmed all of the above and are still facing issues, consider reviewing the documentation for setting up external models and database scoped credentials in SQL Server 2025 to ensure compliance with any additional requirements.

References:

Share via

How to fix the identity issue in sql server 2025 AI feature while setting up Vector features

2 answers

Credential name rules for external model

Your answer