Using Windocks with Azure Active Directory Domain Services (AADDS)

Setting up users using SSMS

Prior to installing Windocks on the VM, you can set up users in your default (base) SQL Server instance that can be automatically provisioned when creating new database containers.  You can also use SSMS to add users after Windocks has created SQL Server containers.

For example, if you want a specific user to have administrator privileges, you can use SQL Server Management Studio (SSMS) to add those users by email name.  SSMS can automatically convert the email name to the SamAccountName format used by SQL Server for Windows authentication.

To utilize SSMS to add users:

1. Login to the Azure VM connected to the AADDS domain as administrator.
2. Launch SSMS and connect to the SQL Server default instance using Windows authentication.
3. Right click on Security and choose New, Login...
   
   
   
   
4. From the Login - New dialog box, with the Windows authentication radio button selected, click Search...
5. From the Select User or Group dialog box, enter the email address of the user you want to add.
   
   
   
   
6. Click Check Names.  You may be prompted for your Azure Active Directory credentials. SSMS should resolve the email address to an Azure Active Directory username.
   
   
   
   
7. Click OK to dismiss the Select User or Group dialog box.  SSMS looks up the SamAccountName for the AAD user and populates it automatically in the Login - New dialog box.
   
   
   
   
8. Click OK to dismiss the Login - New dialog box.  Your login has been created.
9. If you want to assign the new user system administration privileges, expand the Security→Logins tree, right click your user. and choose Properties.
   
   
   
   
10. In the Login Properties dialog box, check sysadmin and click OK.
    
    
    
    

Congratulations!  If you added this user to the default instance, this user will now be included in all database containers you create with Windocks.

You can also follow these instructions when connecting to database containers as an administrator to add users to that specific container.

Getting SamAccountName for AADDS users

You can use Powershell to get information about AADDS users through its synchronization with Azure Active Directory.  To install the necessary Powershell module, launch Windows PowerShell and use the following commands.

The following session shows an example of using Get-ADUser to output SamAccountName for users in Azure Active Directory.

You can now use these SamAccountName values to create users and add roles to your database via script.  Again, if you do not want to use SamAccountName, you can manage users via SSMS.