Set up MIM Synchronization Service with Azure SQL Server

A typical deployment of MIM Synchronization Service requires a Windows Server to host the MIM software and a SQL Server database to host the configuration and data. This article walks you through an alternative deployment option that uses Azure SQL instead of an on-premises SQL Server instance.

In this article, you create an Azure resource group, configure a virtual machine, deploy an Azure SQL database with private endpoint connectivity, and configure managed identity authentication.

Prerequisites

• An active Microsoft Azure subscription.
• An Azure resource group. If you need to create one, see Create resource groups.

Configure roles and a managed identity

Verify that you have the required roles on your resource group, and then configure a managed identity for authentication to Azure SQL Server.

1. Ensure that you have at least the Contributor and User Access Administrator roles assigned on the resource group. These roles are required to create resources and assign the managed identity. If you need to use the Owner role, consider using Privileged Identity Management (PIM) for just-in-time access.

2. Choose an Azure SQL authentication method. You can use either of the following options:

   • Option 1 - User Assigned Managed Identity (recommended): Create a User Assigned Managed Identity in the resource group. This identity is used to authenticate MIM Synchronization Service to the Azure SQL Server instance. For example, name it contoso-mim-uami.

   • Option 2 - System Assigned Managed Identity: Enable the System-Assigned Managed Identity for the MIM Synchronization Service virtual machine later in the process, during virtual machine creation.

Create a MIM Synchronization Service virtual machine

Set up a Windows Server virtual machine to host the MIM Synchronization Service software.

1. Create a new virtual machine based on Windows Server 2019 or later. Windows Server 2022 is recommended. The minimum recommended size is Standard_DS2_v2 (2 vCPUs, 7 GB RAM).

2. During virtual machine creation, choose to create a new virtual network. You need this virtual network later to add the Azure SQL Server into the same network, or to set up peering between the MIM Synchronization Service virtual machine network and the Azure SQL Server virtual network.

3. Configure the managed identity for your virtual machine based on the option you chose earlier:

   • If you chose Option 1 (User Assigned Managed Identity): After the virtual machine is created, go to the Identity tab under Settings and add the User Assigned Managed Identity you created earlier (for example, contoso-mim-uami).

   • If you chose Option 2 (System Assigned Managed Identity): During virtual machine creation, enable the System assigned managed identity option to allow passwordless authentication from this virtual machine to the Azure SQL Server instance.

4. (Optional) Enable Login with Microsoft Entra ID to sign in to your virtual machine with your Microsoft Entra ID account.

5. (Optional) Instead of enabling RDP access from the internet, restrict RDP access to your VPN subnet and set up a static route to the MIM Synchronization Service virtual machine public IP through your VPN tunnel.

6. Select Review and Create to create the virtual machine.

7. (Optional) After the virtual machine is created, go to Access Control (IAM) and add a role assignment. Select Virtual Machine Administrator Login and assign it to the account you use to sign in to the virtual machine.

Create an Azure SQL database

Deploy an Azure SQL database with private endpoint connectivity to securely connect to the MIM Synchronization Service virtual machine.

1. Create a new Azure SQL Server instance in the resource group. Choose Single database as the SQL deployment option.

2. Enter the database name and choose to create a new server.

3. Provide the Azure SQL Server name and location.

4. Select Microsoft Entra-only as the authentication method.

5. Add the account that you use to connect to the MIM Synchronization Service virtual machine as a Microsoft Entra admin for the Azure SQL Server.

   Important

   While the recommended MIM Synchronization Service Windows Server VM and Azure SQL Server configurations settings are defined below, users should test these settings in a preproduction environment to determine what's optimal for their transactional load before deploying to production

6. Choose your workload environment (for example, Development) to size the Azure SQL Server instance. Adjust the database configuration as needed, such as adding more vCores or increasing the maximum storage size. For testing, you can keep the remaining default settings.

7. On the Networking tab, select Private endpoint as the connectivity method and select + Add private endpoint.

8. Ensure the same resource group and location are selected, and provide a name for your private endpoint.

9. Select the same virtual network that you used when you created the MIM Synchronization Service virtual machine (or plan to set up peering between networks later).

10. Enable Private DNS integration and select Add.

11. Keep the default connection policy and the minimum TLS version set to TLS 1.2, and then create the SQL Server and SQL database.

Set permissions on the Azure SQL database

Configure the managed identity as a database user with the appropriate role to allow MIM Synchronization Service to access the database.

Open the SQL Query Editor for your new database and run the following SQL commands. Replace <managed-identity-name> with the name of your User Assigned Managed Identity or System Assigned Managed Identity.

create user [<managed-identity-name>] from external provider;
alter role db_owner add member [<managed-identity-name>];

Next step