Cannot find the Active Directory object '' in tenant

Question

How do I resolve this issue? anyone experience this before? I'm trying to enable always encrypted in my sql server database by running the below script as described in the tutorial. I've checked the tenant Id in my azure, and the AAD everything seems fine so not sure why I'm getting this error. It's proving difficult to find any resources/help out there with similar issue.

New-AzureRmKeyVault : The specified vault already exists.
At line:1 char:1
+ New-AzureRmKeyVault -VaultName $akvName -ResourceGroupName $resourceG ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [New-AzureRmKeyVault], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.NewAzureKeyVault

PS C:\Users\xxxxxxx> Set-AzureRmKeyVaultAccessPolicy -VaultName $akvName -ResourceGroupName $resourceGroup -PermissionsToKeys get, create, delete, list, update, import, backup, restore, wrapKey,unwrapKey, sign, verify -UserPrincipalName $azureCtx.Account
Set-AzureRmKeyVaultAccessPolicy : Cannot find the Active Directory object '' in tenant
'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx'. Please make sure that the user or application service principal you are
authorizing is registered in the current subscription's Azure Active directory. The TenantID displayed by the cmdlet
'Get-AzureRmContext' is the current subscription's Azure Active directory.
At line:1 char:1
+ Set-AzureRmKeyVaultAccessPolicy -VaultName $akvName -ResourceGroupNam ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzureRmKeyVaultAccessPolicy], ArgumentException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.SetAzureKeyVaultAccessPolicy

PS C:\Users\xxxxxxx> $akvKey = Add-AzureKeyVaultKey -VaultName "AdeKeyVault1"-Name "ContosoFirstKey" -Destination "Software"

PS C:\Users\xxxxxxx> # Import the SqlServer module.
PS C:\Users\xxxxxxx> Import-Module "SqlServer"
PS C:\Users\xxxxxxx>
PS C:\Users\xxxxxxx> # Connect to your database (Azure SQL database).
PS C:\Users\xxxxxxx> $serverName = "xxxxxxxxxxxxxxxxx.windows.net"
PS C:\Users\xxxxxxx> $databaseName = "Hospital"
PS C:\Users\xxxxxxx> $connStr = "Server = " + $serverName + "; Database = " + $databaseName + "; Authentication
= Active Directory Integrated"
PS C:\Users\xxxxxxx> $connection = New-Object Microsoft.SqlServer.Management.Common.ServerConnection
PS C:\Users\xxxxxxx> $connection.ConnectionString = $connStr
PS C:\Users\xxxxxxx> $connection.Connect()
Exception calling "Connect" with "0" argument(s): "Failed to connect to server (local)."
At line:1 char:1
+ $connection.Connect()
+ ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ConnectionFailureException

PS C:\Users\xxxxxxx> $server = New-Object Microsoft.SqlServer.Management.Smo.Server($connection)
PS C:\Users\xxxxxxx> $database = $server.Databases[$databaseName]
PS C:\Users\xxxxxxx>
PS C:\Users\xxxxxxx> # Create a SqlColumnMasterKeySettings object for your column master key.
PS C:\Users\xxxxxxx> $cmkSettings = New-SqlAzureKeyVaultColumnMasterKeySettings -KeyURL $akvKey.ID
PS C:\Users\xxxxxxx>
PS C:\Users\xxxxxxx> # Create column master key metadata in the database.
PS C:\Users\xxxxxxx> $cmkName = "CMK1"
PS C:\Users\xxxxxxx> New-SqlColumnMasterKey -Name $cmkName -InputObject $database -ColumnMasterKeySettings $cmkSettings
New-SqlColumnMasterKey : Cannot validate argument on parameter 'InputObject'. The argument is null or empty. Provide
an argument that is not null or empty, and then try the command again.
At line:1 char:52
+ New-SqlColumnMasterKey -Name $cmkName -InputObject $database -ColumnM ...
+                                                    ~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [New-SqlColumnMasterKey], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.SqlServer.Management.PowerShell.AlwaysEncrypt
   ed.NewSqlColumnMasterKey

What is the value of `$azureCtx.Account`? Is it the user's UPN? — juunas, Apr 04 '18 at 11:42
Could you try to specify the `-ObjectId` instead of the user principal name? The value would need to be the object id of the user. You can find it with certain PS cmdlets, but also from the Azure Portal's Azure Active Directory -> Users blade. — juunas, Apr 04 '18 at 14:29
Ok when I use objectId I don't get that error but the subsequent errors are still there. i.e Exception calling "Connect" with "0" argument(s): "Failed to connect to server (local)." At line:1 char:1 + $connection.Connect() — user3520410, Apr 04 '18 at 15:11

score 1 · Answer 1 · answered Apr 05 '18 at 02:01

1

It seems you use a Microsoft account(like outlook.com,hotmail.com). The UserPrincipalName is not your e-mail.

As juuas said, you could use User's object ID.

Set-AzureRmKeyVaultAccessPolicy -VaultName $akvName -ResourceGroupName $resourceGroup -PermissionsToKeys get, create, delete, list, update, import, backup, restore, wrapKey,unwrapKey, sign, verify -ObjectId <user id>

answered Apr 05 '18 at 02:01

Shui shengbao

18,746
3
27
45

Thanks for your reply, my problem now is this "Exception calling "Connect" with "0" argument(s): "Failed to connect to server (local)." At line:1 char:1 + $connection.Connect() –" – user3520410 Apr 05 '18 at 08:56
I see you use Active Directory authentication, do you set Azure AD admin? – Shui shengbao Apr 05 '18 at 08:58
See this link https://learn.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure – Shui shengbao Apr 05 '18 at 09:02

Cannot find the Active Directory object '' in tenant

1 Answers1