Learn how managed identities in SQL Server 2025 enhance security by eliminating passwords and enabling seamless Microsoft Entra authentication for Azure resources.

Those who have worked with SQL Server will understand the need to avoid storing passwords for accessing resources. Windows-based identities are fine for on-premises SQL Server systems, including those on cloud-based virtual machines (VMs), but are of no use when you need to access cloud-based resources like those in Azure.

Some Azure-based resources (including storage accounts) offer other access methods, such as shared access signatures (SAS), but these aren’t much of a step-up from passwords.

What’s really needed is for SQL Server to have its own Microsoft Entra based identity. These can be used directly with Azure-based resources – and that’s exactly where managed identities come in.

What are managed identities?

A managed identity is a Microsoft Entra identity that Azure creates and manages for a resource. This allows the resource to obtain tokens for other Azure services without the need for storing passwords, client secrets, or certificates in code or configuration. Two types of managed identities are available.

First, a system-assigned managed identity, which is specific to a resource. For example, I could add a system-assigned managed identity to an Azure Data Factory (ADF). The ADF could then use the identity when making connections to, or accessing, other resources. When the ADF is deleted, the system-assigned managed identity is also removed.

Then there’s a user-assigned managed identity. This is created independently of any specific resource and can be applied to a resource, in addition to any system-assigned managed identity. User-assigned managed identities are very powerful because a single identity can be assigned to multiple resources.

For example, I might have a single identity for a group of data factories. This simplifies the configuration of access and, importantly, if I need to recreate the data factory, I can use the same identity. Even when all the data factories are deleted, the user-assigned managed identity can survive. Another common use for these is to assign the same identity to a group of web servers.

The official Microsoft documentation for managed identities can be found here.

Why managed identities are not just service principals

Under the covers, managed identities are a special kind of service principal, but there are important differences. The major one is that service principals expire, whereas Azure manages the lifecycle and credential rotation of managed identities for you.

I’m always concerned when I see solutions built using service principals without plans for what would happen when they expire. These are like time-bombs at many sites today, but using managed identities avoids these issues. The credential expires after 90 days and is rolled over after 45 days.

The biggest contrast is operational. With a service principal, someone must create an app registration, issue and protect a secret or certificate, and periodically rotate that credential. That might also require updating dependent systems.

What’s needed to use a managed identity?

To be able to use managed identities, you need two things:

You might think that anything that can have a managed identity could also use it for connections, but that’s not the case.

For example, you can assign either or both a system-assigned managed identity and a user-assigned managed identity to an Azure Analysis Services (AAS). However, AAS does not currently provide any way to use that identity when connecting to an Azure-based resource or service.

We currently have AAS servers making connections to Azure SQL Database using logins and passwords, but I wish we didn’t have to do this. It wouldn’t be required at all if we could just specify the managed identity in the connection details.

How do managed identities apply to SQL Server 2025?

It’s increasingly common for SQL Server to need to connect to Azure-based resources. This not only happens with SQL Server in Azure VMs, but also with on-premises SQL Server installations. However, SQL Server is not a native Azure resource or service.

From SQL Server 2025 onwards, it’s possible to both configure and use a system-assigned managed identity when SQL Server is enrolled in Azure Arc. To enable this, the SQL Server instance must be connected to Arc and run on Windows Server. It must also use the latest Azure Extension for SQL Server.

Currently, the documentation notes that SQL Server must have access to Azure public cloud for Microsoft Entra authentication, and that failover cluster instances are not supported for this managed-identity setup. We also can’t (yet) use user-assigned managed identities with SQL Server.

So, we only have part of what we need right now – but it’s a great start.

How to configure and use the managed identity in SQL Server 2025

Once the SQL Server instance is Arc-enabled, you can assign the server’s primary managed identity. You do this from the Azure portal while configuring the properties of the Arc-enabled SQL Server resource, under the Microsoft Entra ID and Purview settings. This primary managed identity is what SQL Server 2025 uses when making outbound connections to Azure-based resources.

You also need to grant the identity permission to the target resource in Azure. The role required is a role-based access control (RBAC) configuration, and will usually be different for each service type.

As part of making an outbound connection, you need to use a database-scoped credential like this:

EXECUTE sp_configure 'allow server scoped db credentials', 1;
RECONFIGURE;
GO
CREATE DATABASE SCOPED CREDENTIAL [storage_credential]
WITH IDENTITY = 'Managed Identity';
GO

Some credentials will also require you to specify a ‘secret’, for example when making a connection to an Azure OpenAI endpoint. Here, you not only specify IDENTITY = ‘Managed Identity’, but also a JSON secret identifying the token audience.

Note that it’s common to name the credential after the scope of the resource you’re accessing:

CREATE DATABASE SCOPED CREDENTIAL
[https://my-azure-openai-endpoint.cognitiveservices.azure.com/]
WITH IDENTITY = 'Managed Identity',
     SECRET = {"resourceid":"https://cognitiveservices.azure.com"}';
GO

This credential can then be used when executing calls like CREATE EXTERNAL MODEL. Once this is done, calls to the external model can use that credential to authenticate without the need to supply an API key.

In summary: managed identities in SQL Server 2025

We still have limitations with how we can configure and use managed identities with SQL Server, but what’s been provided so far is a great start. It lets traditional on-premises (and cloud VM-based) SQL Server instances participate in modern Microsoft Entra-based authentication patterns, and in turn reduce potential issues like credential leakage.

The post What are managed identities in SQL Server 2025? A complete guide appeared first on Simple Talk.

Loan processing breaks where documents begin

Loan processing is document-intensive by nature, and that’s exactly where most workflows break down.

Loan officers juggle email threads, outdated file copies, fragmented review tools, and customers wait for long days for approvals, and incomplete audit trails. When form filling, reviewing, annotating, signing, and approving all happen in separate systems, every transition is a potential point of failure.

This blog shows how to solve that problem by building a complete, role-based loan document review workflow by embedding the Syncfusion^® React PDF Viewer, all inside a single React application. You’ll get a step-by-step walkthrough, key code snippets, and a working GitHub sample to reproduce the full flow.

Experience a leap in PDF technology with Syncfusion's PDF Library, shaping the future of digital document processing.

Explore Now

Why digital loan workflows matter more than ever

Loan processing is the end-to-end sequence that turns an application into a sanctioned loan: intake, verification, review, approval, and delivery. When each stage depends on manual handoffs or disconnected tools, the entire pipeline slows down.

Here’s what that looks like in practice:

• Slow turnaround: Manual routing and email threads add days or weeks.
• Broken context: Reviewers work from copies or fragmented annotations, causing rework.
• Compliance exposure: Incomplete audit trails and versioning gaps increase risk.
• Operational cost: Multiple-point tools and manual steps inflate headcount and processing cost.
• Poor customer experience: Long waits and repeated document requests kill conversion.

In 2026, a unified, auditable digital workflow isn’t just a modernization effort. It’s a competitive advantage that turns loan pipelines into predictable revenue engines.

What a unified digital workflow delivers

Replacing fragmented processes with structured, automated digital document flows in a single interface changes the picture entirely:

• Speed: Digital workflows cut decision time. Faster approvals mean more closed loans.
• Accuracy: Inline validation and single-source PDFs reduce errors and resubmission.
• Visibility: Real-time dashboarding and status badges eliminate chase work for staff.
• Compliance: Embedded signatures, stamps, and audit logs create defensible records.
• Lower cost, higher conversion: Fewer touchpoints, less rework, and better customer experience directly boost margins.

Architecture overview: One app, one document, full traceability

The loan processing application uses a clean, modern architecture that pairs an intuitive frontend review experience with a secure, auditable backend. The result is a seamless end-to-end workflow, form filling, annotation, review, approval, and final PDF generation, all inside a unified digital system.

Technology stack

Frontend (React + Syncfusion PDF Viewer)

A React application embeds the Syncfusion PDF Viewer, enabling users to:

• Fill form fields directly in the browser.
• Add annotations (highlights, comments, notes).
• Apply E-signatures.
• Download final PDFs.

All interactions happen inside a single interface. No external viewers, no file switching, and no context loss.

Backend services

A lightweight backend service handles the business logic and compliance needs:

• Persist annotation JSON for each review cycle.
• Manage workflow status across the loan requester → loan officer → manager.
• Record audit events (timestamps, actions, version history) for compliance.
• Generate flattened PDFs with embedded stamps, signatures, and metadata.
• Store documents with version tracking for future verification or audits.

Together, the stack ensures a secure, traceable, and fully digital review flow.

End-to-end role-based architecture workflow

The loan processing workflow is structured with a role-based workflow, each interacting with the PDF viewer differently:

1. Loan requester: Fills out loan applications, uploads supporting documents, and signs forms.
2. Loan officer: Reviews applications, adds annotations, and provides preliminary approval.
3. Site officer: Verifies the details submitted by the loan requester and completes the verification fields in the loan application.
4. Manager: Final review, approval authority, and sanction letter generation.

This architecture delivers a fully connected, auditable, and efficient loan processing ecosystem powered by an embedded PDF experience.

Building the end-to-end loan processing workflow with Syncfusion React PDF Viewer

Let’s break down the steps to build the loan document review processing workflow using the Syncfusion React PDF Viewer.

Step 1: Initialize the React PDF Viewer

Setting up the Syncfusion React PDF Viewer is quick and developer-friendly. All you need to do is:

• Install the Syncfusion React packages.
• Import the required style CSS reference.
• Then, add the PDF Viewer component to your React app.

From there, you can load PDFs, enable form filling, annotations, and signatures, and connect the viewer to your backend APIs.

Below is a code snippet to initialize the React PDF Viewer component.

import * as ReactDOM from 'react-dom/client';
import * as React from 'react';
import './index.css';
import { PdfViewerComponent, Toolbar, Magnification, Navigation, LinkAnnotation, BookmarkView,
         ThumbnailView, Print, TextSelection, Annotation, TextSearch, FormFields, FormDesigner, Inject} from '@syncfusion/ej2-react-pdfviewer';

function App() {
    return (<div>
    <div className='control-section'>
    {/* Render the PDF Viewer */}
      <PdfViewerComponent
        id="container"
        documentPath="https://cdn.syncfusion.com/content/pdf/pdf-succinctly.pdf"
        resourceUrl="https://cdn.syncfusion.com/ej2/31.2.2/dist/ej2-pdfviewer-lib"
        style={{ 'height': '640px' }}>

         <Inject services={[ Toolbar, Magnification, Navigation, Annotation, LinkAnnotation, BookmarkView,
                             ThumbnailView, Print, TextSelection, TextSearch, FormFields, FormDesigner ]}/>

      </PdfViewerComponent>
    </div>
  </div>);
}

For more details, explore thfaq_e complete setup guide for the Syncfusion React PDF Viewer!

Step 2: Building a unified user login

The application uses a single login page for all four roles:

• Loan Requester
• Loan Officer
• Site Officer
• Manager

Users select their role at login, and after authentication, they’re directed to a role-specific dashboard showing only the tasks, documents, and permissions relevant to their stage in the workflow.

Note: This demo uses mock user-role details. In a production environment, you can integrate it with your organization’s authentication system to enforce actual access control.

Explore the wide array of rich features in Syncfusion's PDF Library through step-by-step instructions and best practices.

Read Now

Step 3: Filling out the loan application

After logging in, the loan requester lands on their dashboard, where they can view existing applications, check statuses, and create a new loan request. The dashboard shows the following key details:

• Loan ID
• Application Name
• Status
• Action
• Comments

When the customer clicks the Create button, the loan form opens directly inside the Syncfusion React PDF Viewer. The loan form includes sections for applicant details, employment information, and loan specifics. Attachment fields allow applicants to upload supporting documents without leaving the interface.

The customers need to complete all required fields, add their e-signature, and submit.

The built-in validation enforces clean data entry. Fields like Date of Birth and Phone Number accept only valid formats, preventing errors before submission.

Refer to the following code example to implement numeric field validation.

if (targetName) {
    // If field name references numeric fields (date, phone, amount, tenure, etc.), enforce digits-only
    const numericKeywords = [
        'date',
        'dob',
        'dateofbirth',
        'phone',
        'mobile',
        'contact',
        'amount',
        'tenure',
        'number',
        'no',
        'age'
    ];

    let isNumericField = numericKeywords.some(k => targetName.includes(k));

    // If the field is a signature field, skip numeric sanitization even if the name contains keywords
    const fieldTypeRaw =
        (args.field && (args.field.type || args.field.fieldType || '')) || '';

    const fieldType = (fieldTypeRaw + '').toString().toLowerCase();
    const isSignatureField = fieldType.includes('signature');

    if (isSignatureField && isNumericField) {
        console.debug(
            'Skipping numeric sanitization for signature field',
            { targetName, fieldType }
        );
        isNumericField = false;
    }
}

Refer to the following image.

Step 4: Site officer reviews

Now, the loan officer checks the loan details filled by the loan requester and forwards them to the site officer for verification.

The site officer can access all pending verification loan forms from their dashboard. Their primary responsibility is to confirm that the information provided by the loan requester is accurate, genuine, and complete. The site officer also fills site‑specific fields and returns the application to the loan officer with all relevant verification details added as comments.

This step introduces an essential layer of field‑level authentication, strengthening the reliability of the loan approval process before the application moves forward for final approval.

See the following image for more information.

Step 5: Loan officer reviews

Loan officers access their dedicated dashboard listing all pending applications. Selecting an application opens it inside the Syncfusion React PDF Viewer.

Loan officers cannot edit fields submitted by the loan requester. Instead, they use annotations, highlights, and comments to review the document and provide structured feedback.

After site officer verification, a loan officer can:

• Request additional information from the loan requester.
• Reject the application with comments.
• Approve and forward to the manager for final review.

Implement the following code example to prevent editing field values submitted by the customer.

/**
 * onDocumentLoad
 */
const onDocumentLoad = () => {
    evaluateFields();

    // Apply read-only mode based on loan status and role
    const canEdit =
        loanStatus === LoanStatus.INFO_REQUIRED &&
        (role === "Manager" || role === "Loan Officer");

    if (
        (!canEdit || loanStatus !== LoanStatus.INFO_REQUIRED) &&
        loanStatus !== ""
    ) {
        readOnly();
    }
};

The following GIF image provides visual clarity about the loan reviewing process.

Step 6: Manager reviews and approvals

Managers hold final approval authority. Their dashboard displays all applications waiting for approval, and each document opens directly inside the Syncfusion React PDF Viewer for review. Managers cannot modify customer-submitted fields but can review all annotations added by other officers and verify supporting documents.

From here, they can:

• Approve the application and trigger the sanction‑letter creation.
• Reject the application with comments.

Once approved, the manager sends the sanction letter to the customer for signature. After the customer signs, the manager completes the final signing and closes the loan process.

The following code example explains how sanction letter fields are populated and locked during the approval stage.

/**
 * UpdateForm
 * Populate sanction letter fields with values collected during approval
 * and set them to read-only.
 */
function UpdateForm() {
    const viewer = viewerRef.current;
    if (!viewer) return;

    let forms = viewer.retrieveFormFields();

    for (let i = 0; i < forms.length; i++) {
        const field = forms[i];

        // Populate sanction fields based on field name
        if (field.name === "ApplicantName") {
            field.value = sanctionValues.name;
        } else if (field.name === "Amount") {
            field.value = sanctionValues.amount;
        } else if (field.name === "Tenure") {
            field.value = sanctionValues.tenure;
        } else if (field.name === "Date") {
            field.value = new Date().toLocaleDateString("en-GB");
        }

        // If the field has a value, update and lock as read-only
        if (field.value !== "") {
            viewer.updateFormFieldsValue(field);
            viewer.formDesignerModule.updateFormField(field, {
                isReadOnly: true
            });
        }
    }
}

Step 7: Downloading the loan sanction letter

After the manager approves the loan, the loan requester’s dashboard updates the application status to “APPROVED.” They can now open the sanction letter directly inside the React PDF Viewer and use the built-in Download option to save a signed copy locally.

Witness the advanced capabilities of Syncfusion's PDF Library with feature showcases.

Try Now

Comparing manual vs. digital loan processing workflow

The move from manual loan processing to an embedded digital workflow significantly reduces delays, errors, and compliance risks. The table below shows how each stage improves when using the Syncfusion React PDF Viewer instead of traditional, fragmented tools.

GitHub reference

Ready to try it yourself? Clone the Loan processing demo on GitHub, run it in minutes, and experience a complete end‑to‑end loan review and approval process firsthand.

Syncfusion’s high-performance PDF Library allows you to create PDF documents from scratch without Adobe dependencies.

Try It Free

Build faster, compliant loan workflows directly inside your React app

Thanks for reading! The Syncfusion React PDF Viewer brings together every capability needed to build a seamless, end-to-end digital loan processing workflow directly inside the browser. Its comprehensive built-in features eliminate the need for external tools, reduce operational friction, and ensure a secure, compliant loan lifecycle from app to sanction letter.

Ready to modernize your loan processing? Start exploring the full power of the React PDF Viewer:

• Form filling & annotations: Interactive form fields with validation plus rich markup tools for reviewing documents.
• E‑Signature support: Secure electronic signing without the need for wet signatures.
• Role‑based access: Customizable toolbars and permissions tailored for each user role.
• API & customization: Deep customization with 200+ APIs and easy backend integration for workflow state, audits, and versioning.
• Performance & compliance: Fast, secure rendering (client or server) with GDPR, HIPAA, and SOC 2 compliant infrastructure.
• Multi‑platform support: Works across React, Angular, Vue, Blazor, ASP.NET Core, and more.

If you’re a Syncfusion user, you can download the setup from the license and downloads page. Otherwise, you can download a free 30-day trial.

You can also contact us through our support forum, support portal, or feedback portal for queries. We are always happy to assist you!

Mistral has released Mistral Medium 3.5, a 128-billion parameter model designed to handle instruction following, reasoning, and coding within a single system, and introduced new cloud-based agent capabilities in its Vibe and Le Chat products.

Test SQL Server Backup Performance For Free

Chapters

• *00:00:00* – Introduction
• *00:00:30* – Free Stuff on GitHub
• *00:01:00* – Stored Procedure Overview
• *00:01:27* – Backup Performance Factors
• *00:01:57* – Testing and Iterations
• *00:02:12* – Stored Procedure Functionality
• *00:02:34* – Parameter Parsing
• *00:03:10* – Cross Join and Temp Tables
• *00:03:34* – Logging and Progress
• *00:04:09* – Backup Command Construction
• *00:04:24* – Reporting Results
• *00:04:35* – Throughput Ranking
• *00:04:52* – Compression Settings Report
• *00:04:57* – Impact Analysis
• *00:05:11* – RAM Usage Report
• *00:05:30* – Consistency Report
• *00:05:59* – Example Run
• *00:07:06* – Cleanup Process
• *00:08:09* – Results Display
• *00:08:30* – Small Database Test
• *00:08:46* – Larger Database Considerations
• *00:09:02* – Usage and Testing
• *00:09:13* – GitHub Repository
• *00:09:20* – Open Source Contribution
• *00:09:32* – Script Naming
• *00:09:45* – GitHub Issue Guidance
• *00:10:12* – Conclusion

Going Further

If this is the kind of SQL Server stuff you love learning about, you’ll love my training. Blog readers get 25% off the Everything Bundle — over 100 hours of performance tuning content. Need hands-on help? I offer consulting engagements from targeted investigations to ongoing retainers. Want a quick sanity check before committing to a full engagement? Schedule a call — no commitment required.

The post Test SQL Server Backup Performance For Free appeared first on Darling Data.

Every time America celebrates a major milestone, Philly gets cool new stuff for the occasion. The best part: We get to keep it all.

For the Bicentennial, thousands of people flocked to Philadelphia to watch the Liberty Bell move from its former home in Independence Hall to its own pavilion on Independence Mall. The African American Museum in Philadelphia opened its doors, the first museum of its kind in the nation. And the arrival of Robert Indiana’s LOVE statue forever informally renamed JFK Plaza to LOVE Park.  

And like every milestone national anniversary before, the Semiquincentennial brings the opening of new institutions, including the First Bank of the United States museum, the Philly Pride Visitor Center in Midtown Village, the Pennsylvania Hospital Museum, two new permanent galleries at the National Constitution Center and much more.

Check out this guide to all of Philly’s 2026 birthday presents that residents and visitors alike now get to enjoy.