microsoft / azuredatastudio

Azure Data Studio is a data management and development tool with connectivity to popular cloud and on-premises databases. Azure Data Studio supports Windows, macOS, and Linux, with immediate capability to connect to Azure SQL and SQL Server. Browse the extension library for more database support options including MySQL, PostgreSQL, and MongoDB.
https://learn.microsoft.com/sql/azure-data-studio
MIT License
7.5k stars 882 forks source link

Privileged identity management (PIM) and ADS do not play well #25640

Open shahiddev opened 1 month ago

shahiddev commented 1 month ago

Type: Bug

Hi, We use Entra Privileged Identity Management (PIM) to allow our team to be added to groups that have elevated privs on our SQL DBs in a JIT manner.

When a user is granted access via PIM their new permissions are not reflected in ADS unless they first clear the token cache, restart ADS and then re-sync their account.

Up until version 1.43 all we had to do was to remove and re-add the Azure account in ADS. All versions since 1.43 this process has not longer worked and needs the explicitly token cache clearing and restarting ADS which is not ideal This issue is related to one I reported a long time ago that was closed

This is an issue with the way the token's are being cached - I'm unclear as to what changed since 1.43 that has broken the previous behaviour - potentially the switch related MSAL ?

Azure Data Studio version: azuredatastudio 1.48.0 (4970733324ef8254b7c22a5dc55af7f8a1dea93f, 2024-02-27T00:05:08.293Z) OS version: Windows_NT x64 10.0.22621 Restricted Mode: No Preview Features: Enabled Modes: