Prerequisites for Installation

Orchestrator running in Azure App Service

1. Create a new user managed identity in the resource group, and copy the client ID for future use.

   
   

   

   
   

2. Add the identity to the user assigned identities list for the Orchestrator App Service:

   
   

   

   
   

3. Enable the Azure Active Directory admin for the SQL server where the Orchestrator database is hosted.

   
   

   

   
   

4. Create the SQL login for the identity created at Step 1 for the Orchestrator database and master database. Log into the database with the admin account set at Step 3 and run the following command

   assignment

   CREATE USER [SQLReadWrite] FROM EXTERNAL PROVIDERCREATE USER [SQLReadWrite] FROM EXTERNAL PROVIDER

5. Add user roles on the Orchestrator database (this operation is not required on the master database as well):

   • If the db_owner role is not restricted, then add the role: ALTER ROLE db_owner ADD MEMBER [SQLReadWrite]
   • If the db_owner role is not available, then add the following roles, where SQLReadWrite is the identity name created at step 3:
     assignment

     ALTER ROLE db_datareader ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_datawriter ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]
     GRANT EXECUTE ON SCHEMA::dbo TO [SQLReadWrite]ALTER ROLE db_datareader ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_datawriter ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]
     GRANT EXECUTE ON SCHEMA::dbo TO [SQLReadWrite]

     The db_ddladmin role is only needed during installation or migration. For security reasons, we recommend that you:

   • Remove it after installation or migration

     assignment

     ALTER ROLE db_ddladmin DROP MEMBER [SQLReadWrite]ALTER ROLE db_ddladmin DROP MEMBER [SQLReadWrite]

   • Add it back before upgrade

     assignment

     ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]

6. Update the connection string in Orchestrator by running:

   assignment

   <add name="Default" providerName="Microsoft.Data.SqlClient" connectionString="Data Source=aad-paas-sql.database.windows.net;Initial Catalog=UiPath;User ID=7e8df0ba-bc41-46d1-bd46-6101e45200a8;Authentication=Active Directory Managed Identity;" /><add name="Default" providerName="Microsoft.Data.SqlClient" connectionString="Data Source=aad-paas-sql.database.windows.net;Initial Catalog=UiPath;User ID=7e8df0ba-bc41-46d1-bd46-6101e45200a8;Authentication=Active Directory Managed Identity;" />

   Note:

   • Set USER ID to the value of the client ID created at Step 1.
   • Make sure you use Authentication=Active Directory Managed Identity.
   • No password or token is required.

Orchestrator running in Azure VM

1. Create a new user managed identity in the resource group and copy the client ID for future use.

   
   

   

   
   

2. Add the identity to the user assigned identities list for the VM running Orchestrator.

   
   

   

   
   

3. Enable the Azure Active Directory admin for the SQL server where the Orchestrators database is hosted.

   
   

   

   
   

4. Create the SQL login for the identity created at Step 1 for the Orchestrator database and master database. Log into the database with the admin account set at Step 3, and run the following command:

   assignment

   CREATE USER [SQLReadWrite] FROM EXTERNAL PROVIDERCREATE USER [SQLReadWrite] FROM EXTERNAL PROVIDER

5. Add user roles on the Orchestrator database (this operation is not required on the master database as well):

   • If the db_owner role is not restricted, then add the role: ALTER ROLE db_owner ADD MEMBER [SQLReadWrite]
   • If the db_owner role not available, then add the following roles, where 1SQLReadWrite1 is the identity name created at step 3.
     assignment

     ALTER ROLE db_datareader ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_datawriter ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]
     GRANT EXECUTE ON SCHEMA::dbo TO [SQLReadWrite]ALTER ROLE db_datareader ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_datawriter ADD MEMBER [SQLReadWrite]
     ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]
     GRANT EXECUTE ON SCHEMA::dbo TO [SQLReadWrite]

     The db_ddladmin role is only needed during installation or migration. For security reasons, we recommend that you:

   • Remove it after installation or migration

     assignment

     ALTER ROLE db_ddladmin DROP MEMBER [SQLReadWrite]ALTER ROLE db_ddladmin DROP MEMBER [SQLReadWrite]

   • Add it back before upgrade

     assignment

     ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]ALTER ROLE db_ddladmin ADD MEMBER [SQLReadWrite]

6. Update the connection string in Orchestrator:

   assignment

   <add name="Default" providerName="Microsoft.Data.SqlClient" connectionString="Data Source=aad-paas-sql.database.windows.net;Initial Catalog=UiPath;User ID=7e8df0ba-bc41-46d1-bd46-6101e45200a8;Authentication=Active Directory Managed Identity;" /><add name="Default" providerName="Microsoft.Data.SqlClient" connectionString="Data Source=aad-paas-sql.database.windows.net;Initial Catalog=UiPath;User ID=7e8df0ba-bc41-46d1-bd46-6101e45200a8;Authentication=Active Directory Managed Identity;" />

   Note:

   • Make sure to set USER ID to the value of the client ID created at Step 1.
   • Make sure you use Authentication=Active Directory Managed Identity.
   • No password or token is required.

Reducing the Number of Index Sharding

{
    "template": "*",
    "order": 1,
    "settings": {
        "number_of_shards": 2
    }
}{
    "template": "*",
    "order": 1,
    "settings": {
        "number_of_shards": 2
    }
}