title: Azure SQL Database Private Endpoint DNS and AD/AAD Configuration
body: <p>We have an Azure Express Route that allows us to extend our on-prem network into Azure vNets.  Within one of the vNets/subnet, I have created a private endpoint and associated it to an Azure SQL Database.  I configured this within the Azure SQL DB blade.</p>
  
  <p>From my laptop (across VPN into the corp net), I'm able to connect to the Azure SQL DB using the private IP + SQL Authentication (using the SQL DB server name @).</p>
  
  <p>I'm also able to connect using <strong>AAD Universal with MFA</strong> to the public fqdn/IP.  Love this.</p>
  
  <p>I want to be able to connect using the private IP (using a name) AND AAD Universal w MFA (or even just AAD w Password).</p>
  
  <p>We tried adding a DNS entry to our custom/on-prem AD DNS (an A Record with a custom name - not the fqdn as provided by Azure) that resolves to the private endpoint IP just fine.  However, when we attempt to connect using anything but SQL Auth, we get:</p>
  
  <p>"target principal name is incorrect"</p>
  
  <p><a href="https://i.stack.imgur.com/TTDce.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TTDce.png" alt="SSMS Connection Error Message"></a> </p>
  
  <p>How can we configure this correctly to allow users to connect via name/fqdn with AAD Universal w MFA?</p>
  
  <p>TIA,
  -Pete</p>