Connect IIS app running on Azure VM (AAD DS joined) to Azure SQL using Integrated Authentication

Question

I've been trying to get to through this issue for some time now, and unfortunately, I'm hitting a wall.

We have Azure AD configured with Azure Domain Services. VM's are joined to this domain. We also have Azure SQL Database that we're attempting to connect to from the IIS application running on the VM.

I've followed the official MS docs on this (https://learn.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure) that helped verify Azure AD identities can connect to the Azure SQL DB (I can connect via SSMS to Azure SQL using an Azure AD Admin user. I can then use that ID to generate other contained users, which I have done).

The problem exists when I attempt to authenticate with the database with Active Directory Integration in my connection string. I get two errors, which i'm going to include below.

Now, I have not been able to get past the last one (stating that federation is needed), and in fact, have read numerous things (albeit nothing directly from MS) that says this is simply not supported and that I need to create a federation to get this working, which just seems completely unreasonable given that this is an Azure-only environment.

Connection string included below as well.

I've tried various iterations of that connection string to no avail. If anyone can provide some insight into this, I'd appreciate it greatly!

One last thing, the IIS application pool is running as a user that is both part of the AAD Domain group on Azure AD, and a contained user created on the DB.

Thanks!

I've tried various iterations of the connection string that include removing much of the additional params on the connection string, and the quotes.

I've tried different users on the application pool

End goal is to remove all plain-text PW's from appearing within the connection string to Azure SQL.

First error:

Unable to load adalsql.dll (Authentication=ActiveDirectoryPassword). Error code: 0x2.

Second Error:

[AdalException: Integrated Windows authentication supported only in federation flow.]
   ADALNativeWrapper.ADALGetAccessToken(String username, IntPtr password, String stsURL, String servicePrincipalName, ValueType correlationId, String clientId, Boolean* fWindowsIntegrated, Int64& fileTime) +829
   System.Data.SqlClient.<>c__DisplayClass2_0.<AcquireTokenAsync>b__0() +132
   System.Threading.Tasks.Task`1.InnerInvoke() +121
   System.Threading.Tasks.Task.Execute() +47

Connection String:

name="LocalSqlServer" connectionString="Server=tcp:XXXXX;Initial Catalog=XXXXX;Persist Security Info=False;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Authentication='Active Directory Integrated';" />