Fix PostgreSQL Flexible Server AadAuthPrincipalCreationFailed after moving tenant

Hi Jakob Pedersen,

Thank you for reaching out to Microsoft QA. Below are the detailed steps to resolve your issue.

When moving resources to a new Microsoft Entra tenant, the authConfig.tenantId for Azure Database for PostgreSQL Flexible Server does not automatically update. This causes AadAuthPrincipalCreationFailed errors because the server still references the old tenant.

Unfortunately, there is no direct property update for tenantId on the existing server. The supported approach is:

Recommended Steps

1. Disable AAD Authentication on the PostgreSQL Flexible Server:
   • Use az postgres flexible-server update --disable-active-directory [https://free.blessedness.top/en-us/azure/postgresql/flexible-server/how-to-configure-sign-in-azure-a…]
2. Re-enable AAD Authentication with the new tenant:
   • Configure the new Microsoft Entra admin group or user:
   • az postgres flexible-server update --enable-active-directory --aad-admin <new-admin> https://free.blessedness.top/en-us/azure/postgresql/flexible-server/how-to-configure-sign-in-azure-ad

This effectively refreshes the tenantId without recreating the server.

Important Notes

1.Ensure the new tenant has proper permissions and roles for the admin group.

2.If you also moved Key Vaults, follow the documented steps here: [https://free.blessedness.top/en-gb/azure/key-vault/general/move-subscription#additional-steps-when-s…]

Do let us know if you have any questions and concerns

Thanks,
Manoj

The --disable-active-directory flag was not available for me on that command. However what did work was similar to the Key Vault solution:

1. az postgres flexible-server update --name <dbname> --resource-group <rg> --microsoft-entra-auth Disabled
2. az postgres flexible-server update --name <dbname> --resource-group <rg> --set authConfig.tenantId="<tenant id>"
3. az postgres flexible-server update --name <dbname> --resource-group <rg> --microsoft-entra-auth Enabled

The authConfig.tenantId is now correct.

Afterwards, I was able to add another Entra ID group to the admin list in the Portal. However, I'm still not able to remove the old assigned Admins because it seems like some database resources are owned by that Group. I did run reassign owned by "<group>" to "su"; from psql but perhaps I'm missing something, maybe one of the pgaadauth roles. But it's fine for now, it works without having to recreate anything.

Hi Jakob Pedersen,

Thanks for the update! It's great that you were able to update the tenantId and add the new Entra ID admin group. Let’s now focus on removing the old admin group.

The issue is that some database objects (like tables or schemas) might still be owned by the old admin group. In PostgreSQL, if an admin group owns anything in the database, it won’t let you remove them until those objects are reassigned.

Here’s what you can do:

1. Transfer Ownership of the Old Admin Groups Objects:
   Run this SQL command to transfer ownership of everything the old admin group owns to the new admin group:
   REASSIGN OWNED BY "<old-admin-group>" TO "<new-admin-group>";
   2.Remove Any Superuser Privileges: If the old admin group had special privileges (like superuser rights), you’ll need to remove them:
   REVOKE ALL PRIVILEGES ON DATABASE <dbname> FROM "<old-admin-group>";
   3.Remove the Old Admin Group: After transferring ownership and revoking any privileges, you can remove the old admin group like this:
   DROP ROLE "<old-admin-group>";
   4.Check if It’s Gone: You can run this query to see if the old admin group still exists in the system:
   SELECT * FROM pg_roles WHERE rolname = '<old-admin-group>';
   5.Verify in Azure Portal: Finally, check the Azure Portal to make sure the old admin group is removed from the PostgreSQL Flexible Server’s Entra ID admin list.

Note:

• If you moved Key Vaults, make sure you have updated everything there too. Here’s the Key Vault Migration Guide.

Once you go through these steps, the old admin group should be gone, and your new group will have full access.

Do let us know if you have any queries and concerns.

Thanks,
Manoj