25

I am trying to create a login for an external user to access one of my Azure databases.

I am unable to get past the error of:

Password validation failed. The password does not meet policy requirements because it is not complex enough.

But, I have tried all different combinations - some are crazy complex.

This is an example of my script that fails...

CREATE LOGIN tableau WITH password='__&&**!!!!123**&&__lklkjljkjkl*&*&%^&^$%lkjlkjklhJHGJHGJ'
GO

I have the "master" database selected and I am following instructions in this article:

How to create custom user login for Azure SQL Database

Can anyone suggest what I might be doing wrong please?

Thanks

5
  • 4
    That's not a very complex password. It has lots of repeated characters and patterns. Use a password generator.
    – elixenide
    Dec 8, 2015 at 13:44
  • @EdCottrell thanks! - you were correct. I used a password generator and it has worked. Dec 8, 2015 at 13:47
  • 6
    @EdCottrell I beg to differ - with 57 characters, involving lowercase, uppercase and symbols that is a super complex password. There is no brute force engine, and probably there never will be, that's going to crack this before the universe collapses. What you see as patterns are just as random as any other combination of 57 characters. Even if those were proper English words it would be ultra complex - xkcd.com/936. The only reason this failed in SQL Azure is because it's over 16 characters - if anything, it's too complex. Mar 26, 2016 at 13:40
  • @OhadSchneider You're overestimating the level of entropy involved in that password. The repetitions, combined with the many keyboard-adjacent characters, and the use of only two rows of keys (the number keys and the middle row, which is the most-used row) makes the password much less random than your estimate. Please don't misunderstand me; it's still very complex in human terms, and it's much better than password123. But it's nowhere near as complex as 57 random characters, and a non-naive algorithm could brute-force it much faster than 57 truly random characters.
    – elixenide
    Mar 26, 2016 at 13:48
  • 4
    And what non-naive algorithm would that be? Can you point to any actual brute force implementation that will have better luck with such a "patternized" password? Maybe if you had a wordlist that happened to contain stuff like lklk, jkjkjk, JHGJ as passwords, and then you tried combining 3-4 passwords, plus you had crazy special symbol rules that tried adding a ridiculous amount of &*123 etc. in various positions, then you would lose a few bits of entropy. I'm willing to bet it will still be much harder to crack by many orders of magnitude than a truly random 10 characters password. Mar 26, 2016 at 17:30

4 Answers 4

31

From this article https://msdn.microsoft.com/en-us/library/azure/jj943764.aspx you have to meet these requirements:

8 characters minimum and 16 characters maximum

Requires 3 out of 4 of the following:

Lowercase characters

Uppercase characters

Numbers (0-9)

Symbols (see password restrictions above)

0
19

Also, the password cannot contain the login-name in it.

i.e. if login-name is MyApiLogin then the password cannot be 20!8MyApiLogin2@18.

Even though it contains all the required as stated in the previous answers

Requires 3 out of 4 of the following:

Lowercase characters

Uppercase characters

Numbers (0-9)

Symbols

3
  • 2
    Or the database name. I had something like the following and it didn't like it: db: mydb login: mylogin password: Abc1234mydb!$
    – theyetiman
    Nov 23, 2018 at 10:23
  • Key info - "password cannot contain the login-name in it." May 11, 2020 at 22:44
  • 1
    @ShawnElihis Avoid even containing parts of the login name. I tried login name as abc_testMyApp and password as abcSome32!thing did not work. But, password Some32!thing worked.
    – nam
    Nov 2, 2021 at 21:09
11

The 8-16 character limit is for Azure AD account passwords, not SQL login passwords. This article https://learn.microsoft.com/en-us/sql/relational-databases/security/strong-passwords gives the following recommendations for strong passwords

  • Is between 8 and 128 characters.
  • Combines letters, numbers, and symbol characters within the password.
  • If used in an OLE DB or ODBC connection string, a login or password must not contain the following characters: [] {}() , ; ? * ! @
1
0

Avoid giving login name in the password. It will throw an error. Minimum 8 characters should be present. Any 3 of these should present:

  • A-Z
  • a-z
  • 0-9
  • Special Character

Please check this link to know the characters allowed. https://learn.microsoft.com/en-us/previous-versions/azure/jj943764(v=azure.100)?redirectedfrom=MSDN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.