Connect Azure Databases with Managed Identity

Kanva can connect to supported Azure databases without storing a database password. The Delphi data agent obtains a Microsoft Entra access token from its Azure managed identity and presents that token to the database.

Supported database systems:

• Azure SQL Database
• Azure Database for PostgreSQL Flexible Server
• Azure Database for MySQL Flexible Server

info

Managed identity removes the database password from Kanva, but it does not grant database access by itself. A database administrator must create a database principal for the identity and grant the required permissions.

Prerequisites

Before creating the Kanva data source, confirm all of the following:

1. The Delphi data agent runs on an Azure resource with a system-assigned or user-assigned managed identity.
2. Microsoft Entra authentication is enabled on the database server.
3. A Microsoft Entra administrator is configured for the database server.
4. The managed identity has a database principal with permission to read the required schemas and tables.
5. Network rules allow the Delphi agent to reach the database endpoint and port.

Azure role assignments and database permissions are separate. An Azure RBAC role on the server resource does not replace the database principal and database grants.

Identify the Delphi managed identity

For an Azure Container Apps deployment using a system-assigned identity:

az containerapp show \
  --resource-group <resource-group> \
  --name <delphi-container-app> \
  --query identity \
  --output json

The returned principalId is the Microsoft Entra object ID. Retrieve the identity display name and client ID with:

az ad sp show \
  --id <principal-id> \
  --query '{displayName:displayName, clientId:appId, objectId:id}' \
  --output json

For a system-assigned identity, leave the Delphi ManagedIdentityClientId environment variable unset. For a user-assigned identity, assign the identity to the Delphi runtime and set ManagedIdentityClientId to its client ID.

Grant database access

Use least-privilege permissions appropriate for the data Kanva needs to read.

Azure SQL Database

Connect to the target database as its Microsoft Entra administrator and run:

CREATE USER [<managed-identity-name>] FROM EXTERNAL PROVIDER;
ALTER ROLE [db_datareader] ADD MEMBER [<managed-identity-name>];
GRANT VIEW DEFINITION TO [<managed-identity-name>];

db_datareader permits reads from all user tables and views in the database. Use explicit GRANT SELECT statements instead when Kanva should access only selected schemas or tables.

Verify the principal and role membership:

SELECT
    member_principal.name,
    member_principal.type_desc,
    member_principal.authentication_type_desc,
    role_principal.name AS role_name
FROM sys.database_principals AS member_principal
LEFT JOIN sys.database_role_members AS role_members
    ON role_members.member_principal_id = member_principal.principal_id
LEFT JOIN sys.database_principals AS role_principal
    ON role_principal.principal_id = role_members.role_principal_id
WHERE member_principal.name = N'<managed-identity-name>';

See Microsoft's managed identity guidance for Azure SQL and CREATE USER reference.

Azure Database for PostgreSQL

Enable Microsoft Entra authentication, configure an Entra administrator, then connect as that administrator and create a role for the managed identity:

SELECT *
FROM pgaadauth_create_principal('<managed-identity-name>', false, false);

GRANT CONNECT ON DATABASE <database-name> TO "<managed-identity-name>";
GRANT USAGE ON SCHEMA <schema-name> TO "<managed-identity-name>";
GRANT SELECT ON ALL TABLES IN SCHEMA <schema-name> TO "<managed-identity-name>";

If Kanva must read tables created later, configure suitable default privileges for the role that creates those tables.

Follow Microsoft's current PostgreSQL managed identity setup and Microsoft Entra role management guidance.

Azure Database for MySQL

Azure Database for MySQL requires Microsoft Entra authentication and a configured server identity and Entra administrator. Create the managed identity as an Entra-enabled MySQL user, then grant SELECT only on the databases or tables Kanva needs.

The server identity may require Microsoft Graph permissions to resolve Microsoft Entra users, groups, applications, and managed identities. Follow Microsoft's current MySQL Microsoft Entra setup before creating the Kanva data source.

Create the data source in Kanva

Open Data Sources, select New Data Source, then choose ODBC Database or the Azure managed identity database option.

Enter these values:

Field	Azure SQL	PostgreSQL	MySQL
Name	A descriptive Kanva name	A descriptive Kanva name	A descriptive Kanva name
Type	SQL Server	PostgreSQL	MySQL
Authentication	Azure Managed Identity	Azure Managed Identity	Azure Managed Identity
Server	Server FQDN, optionally with port	Server FQDN	Server FQDN
Database	Target database name	Target database name	Target database name
Database Identity Name	Not shown	Database role created for the managed identity	Microsoft Entra database user or configured alias
Password	Not displayed or required	Not displayed or required	Not displayed or required

For Azure SQL, a typical server value is:

example.database.windows.net,1433

The generated connection information must not contain UID, User, PWD, or Password values.

Create a data set

After creating the data source:

1. Open Data Sets and select New Data Set.
2. Open the Azure tab.
3. Choose Azure Database.
4. Select the managed identity database source, enter the data set name and SQL query, then submit the form.

The Azure Database selector lists only database sources configured with Azure Managed Identity. The General tab's ODBC Database option remains available when you need to select from every database source, including password-authenticated sources.

Local development

Local Delphi processes try the signed-in Azure CLI identity before other default Azure credentials:

az login
az account set --subscription <subscription-id-or-name>

Leave ManagedIdentityClientId unset when testing with the Azure CLI identity. The signed-in user still needs a database principal and read permissions. Azure SQL does not require a separate database identity field. PostgreSQL and MySQL require the exact database role or Microsoft Entra user name expected by the database connection.

ManagedIdentityClientId and Database Identity Name are different settings. The environment variable selects a user-assigned managed identity for token acquisition. The form field supplies the database login name created for that identity.

Troubleshooting

Token acquisition fails

• Confirm the Delphi runtime has the intended managed identity.
• For a user-assigned identity, confirm ManagedIdentityClientId contains the client ID, not the object ID.
• For local development, run az account show and verify the selected tenant and subscription.

Login fails after a token is acquired

• Confirm the database principal exists in the target database, not only in the server or Azure resource group.
• Confirm the principal represents the same identity used by Delphi.
• Confirm the principal has permission to connect and read the required objects.
• For PostgreSQL and MySQL, confirm Database Identity Name exactly matches the role, Microsoft Entra user, or configured alias in the target database.

Connection times out

• Confirm the database server FQDN and port.
• Check public access, firewall rules, private endpoints, DNS, and virtual network routing.
• Confirm the Delphi runtime, rather than the Hub or client device, can reach the database.

Kanva can connect but cannot list or query tables

• Grant schema visibility and SELECT permissions.
• For Azure SQL, verify db_datareader membership or explicit grants and VIEW DEFINITION.
• For PostgreSQL, verify CONNECT, schema USAGE, and table SELECT grants.