topic Re: SQL Server Kerberos Authentication in Open Q&A

SQL Server Kerberos Authentication

barryla — Tue, 22 Jul 2025 12:24:11 GMT

I would like to know if the following would be possible.

We have > 500 MS SQL Instances that we want to monitor on Dynatrace.
We would like to use Kerberos authentication to connect to the instances.
We want to create a new domain account for the connection from Dynatrace ActiveGate to the SQL Instances.
We don't want to use the SQL Service Account for the monitoring.
How do we register the new domain account to allow us to communicate from the ActiveGate to the SQL Instance?

What setspn configuration do we need to allow for the communication?

Re: SQL Server Kerberos Authentication

p_devulapalli — Fri, 18 Jul 2025 00:01:32 GMT

@barryla Kerberos authentication is already supported for MS SQL extensions , you should be able to configure it when adding endpoints in extension

https://docs.dynatrace.com/docs/shortlink/extend-microsoft-sql#define-endpoints

https://docs.dynatrace.com/docs/ingest-from/extensions20/data-sources/sql/microsoft-sql-monitoring#authentication

"authentication": { "scheme": "kerberos", "username": "username", "password": "password", "realm": "realm", "kdc": "kdc" }

Re: SQL Server Kerberos Authentication

barryla — Fri, 18 Jul 2025 04:31:31 GMT

Thank you p_devulapalli but the documentation is not complete on the requirements for Kerberos on what is needed. As mentioned in my post, I do not want to use the SQL Service Account but want to use a new domain account for the monitoring.

I need to see where it says how to configure the SPN configurations for the domain account to connect to the SQL instance.

Re: SQL Server Kerberos Authentication

kayjayeff1 — Wed, 17 Dec 2025 13:44:52 GMT

@barryla did you have any luck getting this figured out? I am in similar situation, but need to connect to an Azure SQL Managed Instance, but should be similar method.

thanks!