Mendix App integration with Azure SQL Managed Instance via Entra ID Authentication(App Registry/Service Principle)

0
I would like to pull some master data from Azure SQL Managed Instance DB, and would like to perform a secure connection from Mendix app using Entra ID authentication(using Azure App registry/Service Principle). Please share your knowledge if someone already come across this scenarion. It is worth to share the steps and code to achieve this DB connection from Mendix app.
asked
1 answers
0

Hi Sudesha,


You can connect a Mendix application to Azure SQL Managed Instance using Microsoft Entra ID (formerly Azure AD) authentication with an App Registration and Service Principal. You can use Mendix's External Database Connector with the Microsoft SQL Server JDBC driver to retrieve master data without relying on SQL authentication.


1. Register an application in Microsoft Entra ID

In the Azure portal:

  1. Navigate to Microsoft Entra ID → App registrations.
  2. Create a new application.
  3. Note the Application (client) ID and Directory (tenant) ID.
  4. Create a client secret under Certificates & secrets and securely store its value.

The client ID and secret will be used by the JDBC driver to authenticate the Mendix application.


2. Grant the application access to Azure SQL Managed Instance

First, ensure Microsoft Entra authentication is configured for your SQL Managed Instance.

Connect to the target database as a Microsoft Entra administrator and create a database user for the service principal:


CREATE USER [YourAppRegistrationName] FROM EXTERNAL PROVIDER;

ALTER ROLE db_datareader
ADD MEMBER [YourAppRegistrationName];

Replace YourAppRegistrationName with the actual application registration's display name.

The example grants read-only access, which is appropriate if Mendix only needs to retrieve master data. Grant additional permissions only if required.

If SQL Server cannot resolve the application identity, check the Managed Instance identity and its Microsoft Graph/Directory Readers permissions.


3. Configure the Mendix External Database Connector

Use the External Database Connector to create an external database connection for Microsoft SQL Server.

For the JDBC driver, use a connection string similar to this:

jdbc:sqlserver://<managed-instance-hostname>:1433;databaseName=<database-name>;encrypt=true;trustServerCertificate=false;authentication=ActiveDirectoryServicePrincipal;

Configure the connection credentials as follows:

Property

Value

Username

Application (client) ID

Password

Client secret

Authentication

ActiveDirectoryServicePrincipal

Database

Your Azure SQL Managed Instance database

The Microsoft SQL Server JDBC driver supports ActiveDirectoryServicePrincipal authentication from version 9.2 onward. Make sure the JDBC driver and its dependencies are compatible with your Mendix and Java versions.

See the official guides:



4. Configure network connectivity

This step is particularly important for Azure SQL Managed Instance.

Ensure the deployed Mendix runtime can reach the Managed Instance hostname and port. If the database is accessible only through a private network, you will need a supported network connection between the Mendix hosting environment and that network.

A successful connection test from Studio Pro on your laptop does not necessarily mean the deployed Mendix application can connect.


5. Retrieve master data in Mendix

Once the connection works:

  1. Create an SQL SELECT query in the External Database Connection document.
  2. Define the result mapping for the columns you need.
  3. Use the Query External Database activity in a microflow.
  4. Process the returned data in your Mendix application.

For example:


SELECT EmployeeID, EmployeeName
FROM dbo.EmployeeMaster;

The External Database Connector supports querying external relational databases and mapping the results into Mendix entities.


Security recommendation: Store the client secret in a protected environment-specific configuration value. Never hardcode it in a Java Action or expose it in application logs.


Hope this helps.













answered