6.3 IAM-Managed Applications Connecting Directly

In this scenario, an application or AI agent is registered in an IAM system (Microsoft Entra ID or OCI IAM) and connects to the database directly as an application identity, using its own database-access token from IAM. This scenario is typical for services, autonomous AI agents, and scheduled jobs that access protected data with their own bounded data scope.

For an overview of the use case and authentication flow, see Applications Connect Directly to the Database.

Configuration path

1. In your IAM system, register the database as an OAuth resource. Then register the application or AI agent as an OAuth client. Assign the application the IAM roles that define its access, and authorize it to obtain a database-access token for the database resource by using its client credentials.

   Depending on your IAM provider, use the applicable registration steps from one of the following topics:

   • For Microsoft Entra ID, see Configure Microsoft Entra ID for Application-Mediated Access.
   • For OCI IAM, see Configure OCI IAM for Application-Mediated Access.

   Note:

   For this direct-logon scenario, configure only the database and application registrations, roles or groups, scopes, and token permissions required for the application to obtain a database-access token. End-user registration is not required unless the same application also supports end-user access flows.
2. Configure the database. See Set Up IAM Integration for Application Direct Logon.
3. Configure the application or AI agent to authenticate to IAM by using its OAuth client credentials, obtain a database-access token for the database resource, and use that token to connect directly to the database. For the connection settings used to present the token to the database, see Configure a SQL Client for End-User Direct Logon.