Using a User-managed Identity to access my PostgreSQL Flexible Server

Question

Hello,

How do i give a UAMI access to my PSQL Flexible Server?
I am able to add Entra Admins (myself) in the Portal and then connect to it using ADO.NET, providing my email as the username. But how do i do it for an UAMI?

Through some research i noticed a lot of suggestions adding the pgaadauth extension. But this is not in the list of extensions i can add in Server Parameters in my PSQL server, and none of the functions are available to use.

Answer 1

Hi **Adrian Brenne,

**You don’t actually need to install a pgaadauth extension yourself (it’s built into the Flexible Server image), you just need to:

Enable & assign your User-Assigned Managed Identity (UAMI) to the server

• In the Azure portal go to your PostgreSQL Flexible Server → Identity → User assigned → Add your UAMI Promote that same UAMI to be an Entra (AAD) administrator on the server - In the portal go to Azure Database for PostgreSQL → Active Directory admin → Add → select your UAMI

1. Create the matching Postgres role inside your database
   Option A – use the built-in pgaadauth helper (connect to the default “postgres” database as the AAD admin):

      Select *FROM pgaadauth_create_principal('YourUamiName', false, false);
   

   1. Option B – manually create a role using the client-ID as the password:

      -- turn off strict OID checks
      CREATE ROLE yourUamiRoleName 
      WITH LOGIN 
      PASSWORD 'CLIENT_ID' 
      IN ROLE azure_ad_user;
   

Connect using your UAMI role + token

• From your VM or App Service, retrieve a token from the IMDS endpoint

 curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://ossrdbms-aad.database.windows.net&client_id=<CLIENT_ID>' \
    -H Metadata:true

• Use that token as the password, and connect as yourUamiRoleName@yourServerName with your favorite Postgres client or ADO.NET.

You must run the pgaadauth function (or CREATE ROLE approach) against the built-in postgres database, not a user database.

Ensure your network/NSG allows outbound calls to the AzureActiveDirectory service tag so IMDS can return tokens.

https://learn.microsoft.com/en-us/azure/postgresql/security/security-entra-concepts#database-extensions
https://learn.microsoft.com/en-us/azure/postgresql/security/security-connect-with-managed-identity
https://learn.microsoft.com/en-us/azure/postgresql/security/security-entra-configure

Answer 2

Hi Adrian Brenne,
Thankyou for reaching Microsoft Q&A!
Thanks for reaching out—great question on getting a User-assigned Managed Identity (UAMI) connected to your Azure Database for PostgreSQL Flexible Server. You're right that Entra ID admins (like your email) work seamlessly via the portal, but UAMIs need a few extra steps since they authenticate differently. The good news is you don't need to manually add the pgaadauth extension—it's handled automatically by Azure for Entra auth on Flexible Servers, which is why it's not showing in your server parameters list.

Quick Prerequisites:

• Ensure Microsoft Entra authentication is enabled on your PostgreSQL Flexible Server (check under Settings > Authentication in the Azure portal).
• Assign the UAMI to a resource like a VM where your app runs:

    text
    az vm identity assign -g <resource-group> -n <vm-name> --identities <uami-resource-id>
  

  Grab the UAMI's name or client ID from its portal overview. Step 1: Create the Database Role:

Connect to the postgres database as your Entra admin (using your email and ADO.NET or psql), then run:

text
SELECT * FROM pgaadauth_create_principal('your-uami-name', false, false);

This maps a PostgreSQL role to your UAMI—no superuser or login role needed unless you want them.

Step 2: Grant Permissions:

Assign roles/privileges to the new role as needed, e.g.:

text
GRANT USAGE ON SCHEMA public TO your-uami-name;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO your-uami-name;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO your-uami-name;

Step 3: Connect from Your App/VM

Use DefaultAzureCredential to grab an access token (scope: https://ossrdbms-aad.database.windows.net/.default). Here's a C# example with Npgsql:

csharp
using Azure.Identity;
using Npgsql;

var credential = new DefaultAzureCredential();
var token = await credential.GetTokenAsync(new Azure.Core.TokenRequestContext(new[] { "https://ossrdbms-aad.database.windows.net/.default" }));
var connString = $"Host=yourserver.postgres.database.azure.com;Database=yourdb;Username=your-uami-name;Password={token.Token};Ssl Mode=Require;Trust Server Certificate=true;";
await using var conn = new NpgsqlConnection(connString);
await conn.OpenAsync();

Run this from the VM with the UAMI assigned—it'll auth seamlessly.

Quick Test from VM Bash

text
TOKEN=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2020-07-01&resource=https://ossrdbms-aad.database.windows.net&client_id=<uami-client-id>' -H Metadata:true | jq -r .access_token)
psql "host=yourserver.postgres.database.azure.com port=5432 dbname=postgres user=your-uami-name password=$TOKEN sslmode=require"

Tokens last ~1 hour, so refresh in production apps.

If you hit snags (e.g., role creation fails), double-check Entra admin setup and server firewall rules allow the VM's IP. Let me know the exact error, and we'll troubleshoot!

Answer 3

User-assigned managed identities (UAMI) on Azure Database for PostgreSQL flexible server are currently supported only for specific platform scenarios, not for logging in to PostgreSQL as an application principal the way a user logs in with Microsoft Entra ID.

From the available information:

• System-assigned managed identity (SAMI) on the PostgreSQL flexible server is used by built-in features such as:
  • azure_storage extension when configured with managed-identity authentication.
  • Microsoft Fabric mirrored databases, where the flexible server uses its SAMI to sign requests to Azure Data Lake.
• User-assigned managed identities associated with a PostgreSQL flexible server are used for:
  • Data encryption with customer-managed keys (CMK).

There is no documented support in this context for:

• Using a UAMI as a database login principal (for example, passing the UAMI as a username via ADO.NET), or
• Enabling a UAMI to authenticate directly to PostgreSQL via pgaadauth on flexible server.

Additionally, the guidance here only covers:

• Assigning UAMI to the PostgreSQL flexible server instance itself via CLI (az postgres flexible-server identity assign) so the server can use that identity for CMK encryption scenarios.
• Using Microsoft Entra ID for user/group/service principal/managed identity admins and interactive connections, but not specifically mapping a UAMI to a database role for application sign-in.

Because pgaadauth and UAMI-as-login are not described as supported features in this material, the supported path in this context is:

1. Use Microsoft Entra authentication for users and groups (and optionally a managed identity as an admin) for interactive access.
2. Use managed identities (system- or user-assigned) on the server side for platform features like CMK and azure_storage, not as direct PostgreSQL login identities.

---

References:

• User assigned managed identities
• Managed identities
• How to use Microsoft Entra ID for authentication with Azure Database for PostgreSQL
• Secure your Azure Database for PostgreSQL Server
• Enable Managed Identity for Azure AI services with the azure_ai extension preview
• Enable Managed Identity for Foundry Tools with the azure_ai extension preview