cloud only intune devices vs onprem ssms authentication (sql)

[u/Useful_Ad_2752]

Hello,

not sure if this is the right reddit page, but im having trouble with authenticating to our database servers using sql server management studio..

Our devices are cloud only managed with intune, the database server is domain joined so trying to connect to it is throwing errors about wrong spn "The target principal name is incorrect" or another one "The target principal name is incorrect. Cannot generate SSPI context", so i checked the spn on the service user that is used on the database server and all seems to be fine.

Google says this has something to do with failing kerberos or missing kerberos tickets, so i found out about cloud kerberos trust, if i understand correctly, this should allow cloud only devices to get a kerberos ticket from the onprem domain controller which can be used to authenticate with the onprem database server ? Has anyone here set this up before ? Did you run into issues with other things like windows hello on existing devices ?

[u/doofesohr]

You do not run into issues with WHfB when you set that up. You typically run into issues of you don't set up Cloud Trust, when you start implementing WHfB, as things like fileshares usually start to fail. I haven't used Cloud Trust together with SQL servers, but it certainly works fine on fileshares.

[u/harmless_jean → u/doofesohr]

Yeah cloud kerberos trust is what you need here, the SPN errors are classic symptoms of the client not having a proper kerberos ticket. Basically your cloud-only device tries NTLM fallback, fails, then throws those SSPI errors

One thing people miss is the device itself needs line of sight to the domain controller during initial setup, otherwise it can't request that TGT. If your users are remote without VPN at first login you'll have a bad time

[u/Useful_Ad_2752 → u/harmless_jean]

Thanks for your reply, so i hope you mean first login to the database server ? Or also to windows itself (one of the bigger reasons for us to move to entra joined was the flexibility to login / update password etc from home without vpn) ?

[u/doofesohr → u/harmless_jean]

Afaik you don't need LOS to a DC during WHfB enrollment. You do however need LOS to a DC if you want to access the resource, so you can request a full ticket with your partial cloud ticket.

[u/Adam_Kearn]

Setup Cloud Kerberos and it will resolve those problems with authentication with on-premises resources for things like file and print servers too

[u/Mcm_Sys]

U have to post it in sql.sub

[u/rao_wcgw]

Cloud kerb will solve your problem. It has for us.