PostgreSQL flexible server

Entra authentication

• authConfig: activeDirectoryAuth: 'Enabled' and passwordAuth: 'Disabled' for Entra only (CLI --microsoft-entra-auth Enabled --password-auth Disabled; the CLI defaults are the reverse). Enable it at creation or later.
• Entra admins (users, groups, service principals or managed identities): one at provisioning, more afterwards; the resource is flexibleServers/administrators/<objectId> (az postgres flexible-server microsoft-entra-admin create -g <rg> -s <server> --display-name <name> --object-id <id> --type Group). Don't run the app as the admin: it has CREATEDB and elevated rights.
• App roles: connected as an Entra admin to the postgres database:

SELECT * FROM pgaadauth_create_principal('<managed identity display name>', false, false);
-- or, when display names collide:
SELECT * FROM pgaadauth_create_principal_with_oid('<role name>', '<object id>', 'service', false, false);
GRANT CONNECT ON DATABASE appdb TO "<managed identity display name>";

Arguments: role name (UPN for users, display name for groups and service principals), isAdmin, isMfa. A role linked to a group lets every member sign in with the group's role name; group membership syncs every 30 minutes.

• Tokens are the password: scope https://ossrdbms-aad.database.windows.net/.default (CLI: az account get-access-token --resource-type oss-rdbms), valid 5–60 minutes, checked at sign-in. Microsoft says that from January 2027 tokens for audiences other than ossrdbms won't be accepted.
• With private access, allow outbound to the AzureActiveDirectory service tag, and keep login.microsoftonline.com and graph.microsoft.com resolving publicly, or admin assignment and sign-in fail.

Network: pick one mode at creation

Versions

18 down to 11 are offered. 11, 12 and 13 have been in paid extended support since August 1, 2026 (billing from September 1, 2026; ends March 31, 2027, November 13, 2027 and November 12, 2028). 14's standard support ends January 31, 2027. Enrolment is automatic and charged only while a server runs; upgrade the major version to leave it.

Bicep (Entra only, private access)

// PostgreSQL flexible server: Microsoft Entra only, private (VNet-integrated), with an Entra admin group
param location string = resourceGroup().location
param serverName string
param delegatedSubnetId string // subnet delegated to Microsoft.DBforPostgreSQL/flexibleServers, /28 or larger
param privateDnsZoneId string // a zone ending in .postgres.database.azure.com, linked to the VNet
param adminGroupName string
param adminGroupObjectId string

resource pg 'Microsoft.DBforPostgreSQL/flexibleServers@2025-08-01' = {
  name: serverName
  location: location
  sku: {
    name: 'Standard_D4ds_v5'
    tier: 'GeneralPurpose'
  }
  properties: {
    version: '17'
    authConfig: {
      activeDirectoryAuth: 'Enabled'
      passwordAuth: 'Disabled' // Entra only; the hub's reading is that no administratorLogin is then needed
      tenantId: tenant().tenantId
    }
    network: {
      delegatedSubnetResourceId: delegatedSubnetId
      privateDnsZoneArmResourceId: privateDnsZoneId
    }
    storage: {
      storageSizeGB: 64
      autoGrow: 'Enabled'
    }
    highAvailability: {
      mode: 'ZoneRedundant'
    }
  }
}

resource entraAdmin 'Microsoft.DBforPostgreSQL/flexibleServers/administrators@2025-08-01' = {
  parent: pg
  name: adminGroupObjectId
  properties: {
    principalType: 'Group'
    principalName: adminGroupName
    tenantId: tenant().tenantId
  }
}

Node.js

import pg from "pg";
import { DefaultAzureCredential } from "@azure/identity";

const credential = new DefaultAzureCredential();
const SCOPE = "https://ossrdbms-aad.database.windows.net/.default"; // PostgreSQL and MySQL flexible servers

// The role must exist: SELECT * FROM pgaadauth_create_principal('<identity display name>', false, false);
export const pool = new pg.Pool({
  host: `${process.env.PG_SERVER}.postgres.database.azure.com`,
  database: "appdb",
  user: process.env.PG_USER ?? "", // the role name: UPN for users, display name for groups and identities
  // A function, so every new pooled connection gets a fresh token (tokens last 5–60 minutes)
  password: async () => (await credential.getToken(SCOPE)).token,
  ssl: { rejectUnauthorized: true },
  max: 10,
  idleTimeoutMillis: 30_000,
});

export async function main(): Promise<void> {
  const { rows } = await pool.query<{ now: Date }>("SELECT now() AS now");
  console.log(rows[0]?.now);
  await pool.end();
}

Read replicas, major version upgrades and elastic clusters: reference/postgresql/replicas-upgrades-and-clusters.md. Retired database services: reference/databases/retired-and-replacements.md.

Errors