---
cuppy_hub: azure
cuppy_path: reference/sql/connections-and-auth.md
cuppy_section: docs
cuppy_doc: DCQ3-412T
cuppy_doc_uuid: c4421554-fd79-44ab-92ab-55f5d3d68823
cuppy_permalink: https://cuppy.io/azure/d/DCQ3-412T
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/sql/connections-and-auth
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: b69f70a15806e2ef7db700e4caf2cf3ecccf1cba1f2c24c1bb9d9d5de07a536a
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Azure SQL Database: connections and authentication

## Sign-in: use Microsoft Entra only

- **Entra-only authentication** turns off SQL authentication for everyone, including the server admin login; existing SQL logins stay but can't connect. Set the **Entra admin first** (a group is easiest), then `az sql server ad-only-auth enable -g <rg> -n <server>`, or `administrators.azureADOnlyAuthentication: true` at creation (Bicep in `guides/sql/connect-from-typescript.md`). Check from T-SQL: `SELECT SERVERPROPERTY('IsExternalAuthenticationOnly')` returns 1.
- Who may toggle it: subscription Owner or Contributor, or **SQL Security Manager**. **SQL Server Contributor can't.**
- Not supported with Entra-only on: elastic jobs, SQL Data Sync, some CDC and transactional replication scenarios, `EXEC AS` for Entra group members.
- **Entra admin:** `az sql server ad-admin create -g <rg> -s <server> --display-name <group> --object-id <group object id>`. Removing it disables Entra authentication on the server.

## Database users for apps

Connect as an Entra principal with `ALTER ANY USER` and run, in the **application database** (not `master`):

```sql
CREATE USER [<managed identity or app display name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<managed identity or app display name>];
ALTER ROLE db_datawriter ADD MEMBER [<managed identity or app display name>];
```

- To resolve names, the **server's identity** needs Microsoft Graph `User.Read.All`, `GroupMember.Read.All` and `Application.Read.All` (least privilege, recommended) or the Directory Readers role. Error **33134** while creating a user usually means Conditional Access blocks Graph (`00000003-0000-0000-c000-000000000000`) or the caller is an app; running it as a user works.
- `WITH OBJECT_ID` (preview) names the principal by object ID when display names collide.
- Tokens are for `https://database.windows.net/.default`; drivers (tedious, Microsoft.Data.SqlClient) ask for it themselves.

## Network path

| Setting | Behaviour |
|---|---|
| **Public network access** | Learn gives `Disable` as the default: only private endpoints work, and clients get **47073**. With `Selected networks`, IP rules apply. Spec values: `Enabled`, `Disabled`, `SecuredByPerimeter` |
| **Server-level IP rules** | Up to 256 per server, stored in `master`; `az sql server firewall-rule create -g <rg> -s <server> -n <name> --start-ip-address <ip> --end-ip-address <ip>`. Changing rules while public access is disabled fails with **42101** |
| **Database-level IP rules** | Up to 256 per database, stored in the database; Microsoft prefers them (portable, narrower) |
| **Allow Azure services** | A `0.0.0.0` rule named `AllowAllWindowsAzureIps`: admits **every** Azure resource, **including other customers' subscriptions**. Off by default from the portal. Prefer private endpoints or VNet rules |
| Rule propagation | Up to **5 minutes** (immediate for contained databases without failover); `DBCC FLUSHAUTHCACHE` refreshes |
| **Private endpoint** | `groupId` `sqlServer`, zone `privatelink.database.windows.net`. Public routing isn't blocked until you choose **Deny public network access**. Connect by `<server>.database.windows.net`: logins straight to the private IP or the `privatelink` name fail. With Redirect, allow 1433–65535 between the client and endpoint VNets, or use Proxy |

**Connection policy:** `Redirect` (recommended: clients then talk to the database node directly) needs outbound **1433 to the gateways and 11000–11999 to the region's SQL addresses** (use the `Sql` service tag); `Proxy` needs only 1433; `Default` means Redirect inside Azure and Proxy from outside. Change it with `az sql server conn-policy update -g <rg> -s <server> --connection-type Redirect`. The hub's reading: a client that can reach 1433 but not 11000–11999 shows up as timeouts rather than a clear error.

## TLS

TLS 1.0 and 1.1 ended on **August 31, 2025**; since November 2024 the minimum can't be set below 1.2. Once a minimum is enforced it can't go back to "none". Clients below it get **47072** `Login failed with invalid TLS version`. The spec still lists `None`, `1.0`, `1.1`, `1.2`, `1.3` for `minimalTlsVersion`: set `'1.2'` (or `'1.3'`) explicitly.

## Serverless

- `GP_S_Gen5_<max vCores>`; `autoPauseDelay` in minutes (General Purpose minimum 15, default 60; `-1` turns pause off).
- **The first connection to a paused database fails with 40613** and starts the resume, which usually takes under a minute: retry for at least a minute (`reference/sql/errors.md`).
- Geo-replication, failover groups, long-term backup retention, a DNS alias, SQL Data Sync and elastic job databases keep the database online.

Managed Instance: `reference/sql/managed-instance.md`. Hyperscale, elastic pools and failover groups: `reference/sql/scale-and-continuity.md`.

The 2025-01-01 API also has `retentionDays` for soft-deleted servers (`createMode: Restore`); the hub hasn't found a Learn page for it yet.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->