Azure SQL Managed Instance Onboarding Fails with Error AZURE_SQL2005 | Druva

Problem description

When onboarding an Azure SQL Managed Instance and assigning authentication credentials to the discovered backup set in the Druva Console, the configuration fails, preventing backup jobs from being scheduled or initiated.

You may observe the following symptoms:

Error Message: AZURE_SQL2005: Invalid username/password
Discovery Status: Azure SQL resources are discovered successfully (confirming tenant-level registration and read access are functioning), but credential assignment fails.
Authentication Failure: Manual authentication attempts via the Druva Console fail repeatedly when using standard SQL logins or alternative username formats.

Scenario reproduction:

In the Druva Management Console, discover an Azure SQL Managed Instance under an onboarded tenant.
Attempt to assign authentication credentials to the discovered backup set using a standard SQL administrator or unmapped Entra ID user.
The credential validation check fails with error AZURE_SQL2005.

Cause

This issue occurs when the Microsoft Entra ID (formerly Azure Active Directory) administrator on the target Azure SQL Managed Instance is unassigned, incorrectly set, or not mapped to the Druva Enterprise Application (Service Principal) associated with the Druva subscription registration.

Traceback

AZURE_SQL2005: Invalid username/password

Resolution

Set the Druva Enterprise Application (Service Principal) as the Microsoft Entra ID administrator for the target Azure SQL Managed Instance, then complete credential assignment in the Druva Management Console.

Step 1: Configure Microsoft Entra ID Admin in Azure

Configure the Druva Service Principal as the Microsoft Entra ID administrator by following the instructions in Configure Entra ID Service Principal Authentication in Azure.

Step 2: Assign Authentication in the Druva Console

Assign the configured Service Principal credentials to your Azure SQL Managed Instance backup set by following the steps in Assign Authentication in Druva Console.

Best Practices

Initial Registration Permissions: Ensure the account used for initial tenant registration held the Global Administrator role in Microsoft Entra ID.
Tenant Registration Updates: If role assignments or identity credentials change in Azure, navigate to your Azure Account settings in Druva and run Update Tenant Registration to refresh access tokens.

Verification

In the Druva Management Console, navigate to the configured Azure SQL Managed Instance backup set.
Trigger an ad-hoc backup by selecting Backup Now.
Under the Jobs page, monitor the backup job status.
Confirm that the backup job transitions through the Preparing Backup and Schema Export stages without authentication errors.