Encrypt credentials for on-premises data stores in Azure Data Factory

You can encrypt and store credentials for your on-premises data stores (linked services with sensitive information) on a machine with self-hosted integration runtime.


This article has been updated to use the new Azure PowerShell Az module. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. For Az module installation instructions, see Install Azure PowerShell.

You pass a JSON definition file with credentials to the
New-AzDataFactoryV2LinkedServiceEncryptedCredential cmdlet to produce an output JSON definition file with the encrypted credentials. Then, use the updated JSON definition to create the linked services.

Author SQL Server linked service

Create a JSON file named SqlServerLinkedService.json in any folder with the following content:

Replace <servername>, <databasename>, <username>, and <password> with values for your SQL Server before saving the file. And, replace <integration runtime name> with the name of your integration runtime.

	"properties": {
		"type": "SqlServer",
		"typeProperties": {
			"connectionString": {
				"type": "SecureString",
				"value": "Server=<servername>;Database=<databasename>;User ID=<username>;Password=<password>;Timeout=60"
		"connectVia": {
			"type": "integrationRuntimeReference",
			"referenceName": "<integration runtime name>"
		"name": "SqlServerLinkedService"

Encrypt credentials

To encrypt the sensitive data from the JSON payload on an on-premises self-hosted integration runtime, run New-AzDataFactoryV2LinkedServiceEncryptedCredential, and pass on the JSON payload. This cmdlet ensures the credentials are encrypted using DPAPI and stored on the self-hosted integration runtime node locally. The output payload containing the encrypted reference to the credential can be redirected to another JSON file (in this case 'encryptedLinkedService.json').

New-AzDataFactoryV2LinkedServiceEncryptedCredential -DataFactoryName $dataFactoryName -ResourceGroupName $ResourceGroupName -Name "SqlServerLinkedService" -DefinitionFile ".\SQLServerLinkedService.json" > encryptedSQLServerLinkedService.json

Use the JSON with encrypted credentials

Now, use the output JSON file from the previous command containing the encrypted credential to set up the SqlServerLinkedService.

Set-AzDataFactoryV2LinkedService -DataFactoryName $dataFactoryName -ResourceGroupName $ResourceGroupName -Name "EncryptedSqlServerLinkedService" -DefinitionFile ".\encryptedSqlServerLinkedService.json" 

Next steps

For information about security considerations for data movement, see Data movement security considerations.