Creating an Identity Connector installs the Azure Arc agent on the Exadata VM Cluster VMs, registering them as Azure Arc-enabled virtual machines.

This enables secure communication with the Azure Key Management Service (KMS) using the Azure identity generated by the Arc agent. The Azure Arc agent can communicate with Azure services over either a public network or a private connectivity setup. Learn more about Azure Arc.

Each Exadata VM cluster must have an identity connector enabled to access Azure resources. The identity connector establishes either a public or private connection between the Exadata VM cluster and Azure Key Management resources, depending on the roles assigned.

To generate an access token for your current Azure account, see az account get-access-token .

You can create an identity connector in one of two ways—using the Oracle Exadata Database Service on Dedicated Infrastructure interface or the Database Multicloud Integrations interface.

To view the details of an identity connector, use this procedure.

1. Open the navigation menu. Click Oracle Database, then click Oracle Exadata Database Service on Dedicated Infrastructure.
2. Under Oracle Exadata Database Service on Dedicated Infrastructure, click Exadata VM Clusters.
3. Click the name of the VM cluster of your choice.
4. On the resulting VM Cluster Details page, in the Multicloud Information section, confirm that the Identity connector field displays the identity connector created previously.
5. Click the name of the Identity Connector to view its details.

This step installs the required library on the VM cluster to support Azure Key Vault integration. Ensure that an identity connector is created before enabling Azure Key Management on the Exadata VM Cluster.

1. Open the navigation menu. Click Oracle Database, then click Oracle Exadata Database Service on Dedicated Infrastructure.
2. Under Oracle Exadata Database Service on Dedicated Infrastructure, click Exadata VM Clusters.
3. Click the name of the VM cluster of your choice.
4. On the resulting VM Cluster Details page, in the Multicloud Information section, click the Enable link next to Azure key store.
5. On the resulting Enable Azure key management dialog, click Enable to confirm the operation.

   Confirming the action will install a library on your Exadata VM Cluster.

   The status of Azure key store changes from Disabled to Enabled.

6. To disable Azure key store, click the Disable link.
7. On the resulting Disable Azure key management dialog, click Disable to confirm the operation.

   Disabling the Azure key management removes the library installed during enablement, which will impact the availability of databases configured to use it.

Create Azure Key Vault Managed HSM, Azure Key Vault Premium, or Azure Key Vault Standard, then assign the permission.

For more information, see Create a key vault using the Azure portal.

1. Create a group and add members.

   Azure groups allow you to manage users by assigning them the same access and permissions to resources.

   • To manage group in Azure, you are required to have User Administrator or Groups Administrator role. For more information, see Manage Microsoft Entra groups and group membership.
   • You must create a security group and add members from the Microsoft Azure portal. You must select the Security option as your Group type. For more information, see Create a basic group and add members
2. Assign the following roles based on the type of Azure Key Vault:
   • For Managed HSM:
     • IAM: Reader
     • Local RBAC: Managed HSM crypto officer + Managed HSM crypto user
   • For Key Vault Premium and Standard
     • IAM : Reader + Key Vault Crypto Officer

For detailed steps, refer to Assign Azure roles using the Azure portal.

This is an alternative way to register your Azure key vaults from the OCI console. If you have already registered your vault during the creation of a database in your existing Exadata VM Cluster, you can skip this step.

1. From the OCI console, navigate to Database Multicloud Integrations, and then select Microsoft Azure Integration. From the Microsoft Azure Integration section, select Azure Key Vaults.
   Note
   
   At least one key must be created in the vault on the Azure portal for the registration to succeed.
2. Select the Register Azure key vaults button.
3. From the drop-down list, select your Compartment.
4. From the Azure key vaults section, select an identity connector from the Discover Azure key vaults using connector list.
5. Click Discover.

   The list of Vault name(s) is displayed.

6. Select the check box located next to Vault name.
7. If you want to add tags for your resources, expand the Advanced options section, and then click Add tag.
8. Click Register to register the vault(s) locally in the OCI.
9. Once you register the vault, you can view the Display name, State, Type, Azure resource group,, and Created information of the vaults in the list.
10. Select the vault you are using, and then click the Identity connector associations tab, which lists identity connector associations in the current compartment.
    Note
    
    A default association is automatically created between the vault and the Identity Connector used during the vault registration process. This allows the vault to be used on the Exadata VM cluster associated with that specific Identity Connector.

    If you want to use the same vault in other clusters that are registered with different Identity Connectors (i.e., not the one used during vault discovery), you must explicitly create an association between the vault and those additional Identity Connectors.

11. Click Create association.
12. From the drop-down list, select your Compartment, Azure key vault association name, and Identity connector.
13. If you expand the Advanced options section, you can add Tags for organizing your resources.
14. Review your selections, and then click Create.

This topic covers creating your first or subsequent databases.

1. Open the navigation menu. Click Oracle Database, then click Oracle Exadata Database Service on Dedicated Infrastructure
2. Choose your Compartment.
3. Navigate to the cloud VM cluster or DB system you want to create the database in:

   Cloud VM clusters (The New Exadata Cloud Infrastructure Resource Model): Under Oracle Exadata Database Service on Dedicated Infrastructure, click Exadata VM Clusters. In the list of VM clusters, find the VM cluster you want to access and click its highlighted name to view the details page for the cluster.

   DB systems: Under Oracle Base Database, click DB Systems. In the list of DB systems, find the Exadata DB system you want to access, and then click its name to display details about it.

4. Click Create Database.
5. In the Create Database dialog, enter the following:
   Note
   
   You cannot modify the db_name, db_unique_name, and SID prefix after creating the database.
   • Database name: The name for the database. The database name must meet the requirements:
     • Maximum of 8 characters
     • Contain only alphanumeric characters
     • Begin with an alphabetic character
     • Cannot be part of the first 8 characters of a DB_UNIQUE_NAME on the VM cluster
     • DO NOT use the following reserved names: grid, ASM
   • Database unique name suffix:

     Optionally, specify a value for the DB_UNIQUE_NAME database parameter. The value is case insensitive.

     The unique name must meet the requirements:

     • Maximum of 30 characters
     • Contain only alphanumeric or underscore (_) characters
     • Begin with an alphabetic character
     • Unique across the VM cluster. Recommended to be unique across the tenancy.
     If not specified, the system automatically generates a unique name value, as follows:

     <db_name>_<3_chars_unique_string>_<region-name>

   • Database version: The version of the database. You can mix database versions on the Exadata DB system.
   • PDB name: (Optional) For Oracle Database 12c (12.1.0.2) and later, you can specify the name of the pluggable database. The PDB name must begin with an alphabetic character, and can contain a maximum of eight alphanumeric characters. The only special character permitted is the underscore ( _).

     To avoid potential service name collisions when using Oracle Net Services to connect to the PDB, ensure that the PDB name is unique across the entire VM cluster. If you do not provide the name of the first PDB, then a system-generated name is used.

   • Database Home: The Oracle Database Home for the database. Choose the applicable option:
     • Select an existing Database Home: The Database Home display name field allows you to choose the Database Home from the existing homes for the database version you specified. If no Database Home with that version exists, you must create a new one.
     • Create a new Database Home: Use this option to provision a new Database Home for your Data Guard peer database.

       Click Change Database Image to use a desired Oracle-published image or a custom database software image that you have created in advance, then select an Image Type:

       • Oracle Provided Database Software Images:

         then you can use the Display all available version switch to choose from all available PSUs and RUs. The most recent release for each major version is indicated with a latest label.

         Note
         
         For the Oracle Database major version releases available in Oracle Cloud Infrastructure, images are provided for the current version plus the three most recent older versions (N through N - 3). For example, if an instance is using Oracle Database 19c, and the latest version of 19c offered is 19.8.0.0.0, images available for provisioning are for versions 19.8.0.0.0, 19.7.0.0, 19.6.0.0 and 19.5.0.0.
       • Custom Database Software Images: These images are created by your organization and contain customized configurations of software updates and patches. Use the Select a compartment, Select a region, and Select a Database version selectors to limit the list of custom database software images to a specific compartment, region, or Oracle Database software major release version.

         Region filter defaults to the currently connected region and lists all the software images created in that region. When you choose a different region, the software image list is refreshed to display the software images created in the selected region.

   • Create administrator credentials: (Read only) A database administrator SYS user will be created with the password you supply.
     • Username: SYS
     • Password: Supply the password for this user. The password must meet the following criteria:

       A strong password for SYS, SYSTEM, TDE wallet, and PDB Admin. The password must be 9 to 30 characters and contain at least two uppercase, two lowercase, two numeric, and two special characters. The special characters must be _, #, or -. The password must not contain the username (SYS, SYSTEM, and so on) or the word "oracle" either in forward or reversed order and regardless of casing.

     • Confirm password: Re-enter the SYS password you specified.
     • Using a TDE wallet password is optional. If you are using customer-managed encryption keys stored in a vault in your tenancy, the TDE wallet password is not applicable to your DB system. Use Show Advanced Options at the end of the Create Database dialog to configure customer-managed keys.

       If you are using customer-managed keys, or if you want to specify a different TDE wallet password, uncheck the Use the administrator password for the TDE wallet box. If you are using customer-managed keys, leave the TDE password fields blank. To set the TDE wallet password manually, enter a password in the Enter TDE wallet password field, and then confirm by entering it into the Confirm TDE wallet password field.

   • Configure database backups: Specify the settings for backing up the database to Autonomous Recovery Service or Object Storage:

     • Enable automatic backup: Check the check box to enable automatic incremental backups for this database. If you are creating a database in a security zone compartment, you must enable automatic backups.
     • Backup Destination: Your choices are Autonomous Recovery Service or Object Storage.
     • Backup Scheduling:
       • Object Storage (L0):
         • Full backup scheduling day: Choose a day of the week for the initial and future L0 backups to start.
         • Full backup scheduling time (UTC): Specify the time window when the full backups start when the automatic backup capability is selected.

         • Take the first backup immediately: A full backup is an operating system backup of all datafiles and the control file that constitute an Oracle Database. A full backup should also include the parameter file(s) associated with the database. You can take a full database backup when the database is shut down or while the database is open. You should not normally take a full backup after an instance failure or other unusual circumstances.

           If you choose to defer the first full backup your database may not be recoverable in the event of a database failure.

       • Object Storage (L1):
         • Incremental backup scheduling time (UTC): Specify the time window when the incremental backups start when the automatic backup capability is selected.
       • Autonomous Recovery Service (L0):
         • Scheduled day for initial backup: Choose a day of the week for the initial backup.
         • Scheduled time for initial backup (UTC): Select the time window for the initial backup.

         • Take the first backup immediately: A full backup is an operating system backup of all datafiles and the control file that constitute an Oracle Database. A full backup should also include the parameter file(s) associated with the database. You can take a full database backup when the database is shut down or while the database is open. You should not normally take a full backup after an instance failure or other unusual circumstances.

           If you choose to defer the first full backup your database may not be recoverable in the event of a database failure.

       • Autonomous Recovery Service (L1):
         • Scheduled time for daily backup (UTC): Specify the time window when the incremental backups start when the automatic backup capability is selected.
     • Deletion options after database termination: Options that you can use to retain protected database backups after the database is terminated. These options can also help restore the database from backups in case of accidental or malicious damage to the database.
       • Retain backups for the period specified in your protection policy or backup retention period: Select this option if you want to retain database backups for the entire period defined in the Object Storage Backup retention period or Autonomous Recovery Service protection policy after the database is terminated.
       • Retain backups for 72 hours, then delete: Select this option to retain backups for a period of 72 hours after you terminate the database.

     • Backup Retention Period/Protection Policy: If you choose to enable automatic backups, you can choose a policy with one of the following preset retention periods, or a Custom policy.

       Object Storage Backup retention period: 7, 15, 30, 45, 60. Default: 30 days. The system automatically deletes your incremental backups at the end of your chosen retention period.

       Autonomous Recovery Service protection policy:

       • Bronze: 14 days
       • Silver: 35 days
       • Gold: 65 days
       • Platinum: 95 days
       • Custom defined by you
       • Default: Silver - 35 days
     • Enable Real-Time Data Protection: Real-time protection is the continuous transfer of redo changes from a protected database to Autonomous Recovery Service. This reduces data loss and provides a recovery point objective (RPO) near 0. This is an extra cost option.

6. Click Show Advanced Options to specify advanced options for the database:

   • Management:

     Oracle SID prefix: The Oracle Database instance number is automatically added to the SID prefix to create the INSTANCE_NAME database parameter. The INSTANCE_NAME parameter is also known as the SID. The SID is unique across the cloud VM Cluster. If not specified, SID prefix defaults to the db_name.

     Note
     
     Entering an SID prefix is only available for Oracle 12.1 databases and above.

     The SID prefix must meet the requirements:

     • Maximum of 12 characters
     • Contain only alphanumeric characters. You can, however, use underscore (_), which is the only special character that is not restricted by this naming convention.
     • Begin with an alphabetic character
     • Unique in the VM cluster
     • DO NOT use the following reserved names: grid, ASM
   • Character set: The character set for the database. The default is AL32UTF8.
   • National character set: The national character set for the database. The default is AL16UTF16.

   • Encryption:

     If you are creating a database in an Exadata Cloud Service VM Cluster, then you can choose to use encryption based on encryption keys that you manage. By default, the database is configured using Oracle-managed encryption keys.

     • To configure the database with encryption based on encryption keys you manage:
       Note
       
       If Azure key management is disabled at the VM cluster level, you will have three key management options: Oracle Wallet, OCI Vault, and Oracle Key Vault.
       • OCI Vault:
         1. You must have a valid encryption key in Oracle Cloud Infrastructure Vault service. See Let security admins manage vaults, keys, and secrets.
            Note
            
            You must use AES-256 encryption keys for your database.
         2. Choose a Vault.
         3. Select a Master encryption key.
         4. To specify a key version other than the latest version of the selected key, check Choose the key version and enter the OCID of the key you want to use in the Key version OCID field.
            Note
            
            The Key version will only be assigned to the container database (CDB), and not to its pluggable database (PDB). PDB will be assigned an automatically generated new key version.
       • Oracle Key Vault: Choose a compartment and select a key store from the chosen compartment.
     • To create a database using the Azure key Vault as key management solution:
       Note
       
       If Azure key management is enabled at the VM cluster level, you will have two key management options: Oracle Wallet and Azure Key Vault.
       1. Select your Key Management type as Azure Key Vault.
       2. Select the Vault available in your compartment.
          Note
          
          The Vault list populates only registered vaults. Click the Register new vaults link to register your vault. From the Register Azure key vaults page, select your vault, and then click Register.
          Note
          
          At least one key must be registered in your vaults.
       3. Select the Key available in your compartment.
   • Tags: If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags . If you are not sure whether to apply tags, skip this option (you can apply tags later) or ask your administrator.
7. Click Create Database.

After database creation is complete, the status changes from Provisioning to Available, and on the database details page for the new database, the Encryption section displays the encryption key name and the encryption key OCID.

Learn to change encryption keys between different encryption methods.

1. Navigate to your existing Exadata VM Cluster in the OCI console. Select the Databases tab. Then, select the database resource that you are using.
2. Select the Database information tab, and then scroll down to Key management section.
3. In the Encryption section, verify that Key management is set to Oracle Wallet, and then select the Change link.
4. Enter the following information on the Change key management page.
   1. Select your Key management as Azure key vault from the drop-down list.
   2. Select your Vault compartment that you are using, and then select your Vault that is available in the compartment.
   3. Select the Key compartment that you are using, and then select your Key from the drop-down list.
   4. Click Save changes.

To rotate the Azure key vault encryption key of a container database (CDB), use this procedure.

1. Open the navigation menu. Click Oracle Database, then click Oracle Exadata Database Service on Dedicated Infrastructure.
2. Choose your Compartment.

   A list of VM Clusters is displayed for the chosen Compartment.

3. In the list of VM Clusters, click the name of the VM cluster that contains the database that you want to rotate encryption keys.
4. Click Databases.
5. Click the name of the database that you want to rotate encryption keys.

   The Database Details page displays information about the selected database.

6. In the Encryption section, verify that the Key Management is set to Azure Key Vault, and then click the Rotate link.
7. On the resulting Rotate Key dialog, click Rotate to confirm the action.

To rotate the Azure key vault encryption key of a pluggable database (PDB), use this procedure.

1. Open the navigation menu. Click Oracle Database, then click Oracle Exadata Database Service on Dedicated Infrastructure.
2. Choose your Compartment.

   A list of VM Clusters is displayed for the chosen Compartment.

3. In the list of VM clusters, click the name of the VM cluster that contains the PDB you want to start, and then click its name to display the details page.
4. Under Databases, find the database containing the PDB you want to rotate encryption keys.
5. Click the name of the database to view the Database Details page.
6. Click Pluggable Databases in the Resources section of the page.

   A list of existing PDBs in this database is displayed.

7. Click the name of the PDB that you want to rotate encryption keys.

   The pluggable details page is displayed.

8. In the Encryption section displays that the Key management is set as Azure Key Vault.
9. Click the Rotate link.
10. On the resulting Rotate Key dialog, click Rotate to confirm the action.