Warwick Rudd continues a series:
In Part 1 we built somewhere safe to put the backups: a storage account with a delete lock and a container with a time-based retention policy.
The next problem is getting SQL Server to write to it without giving it a password. That’s what the Managed Identity is for. The VM gets an identity in Microsoft Entra ID, SQL Server uses it to authenticate to storage, and there’s no SAS token or storage key anywhere to steal, rotate or forget about.
There are a few moving parts to get there, and most of the time spent on this is in Entra ID and networking rather than SQL Server.
Read on to see what needs to happen.