How to fix Error 7446 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 7446 – Linked Server MSI Mode Microsoft Entra ID Authentication Disabled

Why This Error Happens

Error 7446 occurs because SQL Server 2025 requires the Managed Identity (MSI) authentication feature for Linked Servers to be explicitly enabled at the service level before it can be used in connection mappings. By default, this feature is disabled as a security precaution since it allows SQL Server to authenticate to external resources using the identity of the host machine or service account. Without enabling the corresponding server configuration option, any Linked Server definition attempting to use Microsoft Entra ID (formerly Azure AD) MSI authentication will fail immediately at the engine level, regardless of correct network or credential setup.

Step-by-Step Resolution Guide

Step 1: Verify Current Server Configuration State

  • Open SQL Server Management Studio (SSMS) or Azure Data Studio connected to the instance throwing Error 7446.
  • Run the following query to check if the feature is currently disabled:
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'Entra ID authentication for linked servers';
  • Confirm the run_value column returns 0, indicating the feature is inactive.

Step 2: Enable MSI Mode Authentication via sp_configure

  • Execute the following T-SQL commands with sysadmin privileges to enable the feature:
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'Entra ID authentication for linked servers', 1;
RECONFIGURE;
  • Restart the SQL Server service for the change to take full effect (required in SQL Server 2025 due to the security-sensitive nature of this flag).
  • On Windows Server 2025 / Windows 11, restart via PowerShell:
Restart-Service -Name 'MSSQLSERVER' -Force

Step 3: Validate the Managed Identity Permissions

  • Ensure the Windows Server 2025 host (or the VM/Container running SQL Server) has a System-Assigned or User-Assigned Managed Identity enabled in Azure.
  • Navigate to Azure Portal > Virtual Machine > Identity and confirm the status is set to “On.”
  • Grant the Managed Identity the necessary role (e.g., Directory Readers or specific SQL DB permissions) in Microsoft Entra ID.

Step 4: Reconfigure the Linked Server Definition

  • Drop and recreate the Linked Server object to ensure it binds correctly to the newly enabled authentication mode:
EXEC sp_dropserver 'YourLinkedServerName', 'droplogins';
EXEC sp_addlinkedserver 'YourLinkedServerName', 'SQLNCLI', 'MSI', 'target_server_name';
  • Ensure the @provider string matches the updated driver requirements for SQL Server 2025 Entra integration.

Alternative or Verification Steps

  • Verification: Run SELECT * FROM sys.servers WHERE name = 'YourLinkedServerName'; and check the is_remote_login_enabled column to ensure it reflects a successful configuration without throwing Error 7446 on a test query (e.g., SELECT * FROM [YourLinkedServerName].[DatabaseName].[dbo].[TableName];).
  • Alternative: If sp_configure changes do not persist after a reboot, verify that the SQL Server Configuration Manager’s startup parameters are not overriding registry settings via a -f (minimal configuration) flag, and ensure the service account has write access to the registry hive HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server.