Azure hub — Databases family (2026-10-21)

What's in it

10 documents including this note, bringing the hub to 95:

• Azure SQL Database: reference/sql/connections-and-auth.md, reference/sql/errors.md, guides/sql/connect-from-typescript.md (Bicep server with Entra-only authentication, the database user, mssql with a token credential and retries).
• Cosmos DB for NoSQL: reference/cosmos-db/access-and-modeling.md (data-plane roles, keys off, partition keys, serverless, Bicep), reference/cosmos-db/errors.md (403, 429 and status codes, @azure/cosmos).
• PostgreSQL flexible server: reference/postgresql/flexible-server.md (Entra roles, network modes, versions, errors, Bicep and pg).
• MySQL flexible server: reference/mysql/flexible-server.md (Entra with a user-assigned server identity, CREATE AADUSER, mysql2).
• Azure Managed Redis: reference/redis/managed-redis.md (retirement of Azure Cache for Redis, tiers, clustering, Entra, Bicep, node-redis).
• Pattern: patterns/app-to-database-with-managed-identity.md.

2026 changes captured

• Azure Cache for Redis retires on September 30, 2028 (Basic, Standard, Premium) and March 31, 2027 (Enterprise tiers); Azure Managed Redis replaces it.
• Paid extended support started automatically: PostgreSQL 11, 12 and 13 on August 1, 2026 (billed from September 1); MySQL 5.7 on October 1, 2026. PostgreSQL 14 and MySQL 8.0 follow on February 1, 2027.
• Entra tokens for PostgreSQL and MySQL must use the ossrdbms-aad audience; Microsoft says other audiences stop working from January 2027.
• TLS 1.0/1.1 ended for Azure SQL and Cosmos DB on August 31, 2025; Azure SQL can't be set below 1.2 since November 2024.
• PostgreSQL 18 is available; the Azure CLI renamed PostgreSQL's ad-admin to microsoft-entra-admin.

How it was checked

• The SQL, Cosmos DB, PostgreSQL, MySQL and Redis docs repositories aren't public, so pages were read on Learn with WebFetch; each provenance entry records the page's own update date. REST specs came from azure-rest-api-specs@c783b658 (SQL 2025-01-01, Cosmos DB 2026-03-15, PostgreSQL 2025-08-01, MySQL 2024-12-30, Redis Enterprise 2025-07-01: the newest with Bicep 0.48.1 types), and one Microsoft CLI sample from Azure-Samples/azure-cli-samples (new pinned repository).
• Every Bicep block builds and lints clean with Bicep 0.48.1. The TypeScript examples (mssql 12.7.10 / tedious 20.3.8, @azure/cosmos 4.10.1, pg 8.23.1, mysql2 3.24.6, redis and @redis/entraid 6.3.0) compile under tsc --strict, and their auth and retry behaviour was read in each package's source. Every az command was checked against Azure CLI 2.91.0 help (348 commands).

Found while checking

• tedious retries login-time 4060, 10928, 10929, 40197, 40501 and 40613 by itself, but only 500 ms apart, and login errors carry no error number (code: 'ELOGIN').
• mysql2 disables the cleartext plugin by default; Azure MySQL Entra sign-in needs enableCleartextPlugin: true.
• Redis Enterprise API 2025-07-01 requires publicNetworkAccess on create; the docs don't say so, Bicep warns.
• Contradictions: the Cosmos DB spec says the TLS default is 1.0 while Learn says Tls12; Cosmos partitioning pages say three or four hierarchy levels; a Microsoft Q&A answer tells users to fix a Cosmos data-plane 403 with az role assignment create, which can't work; the MySQL spec's version enum lacks 8.4.

Known gaps

• Filled the same day by the databases gap fill (changelog/2026-10-21-databases-gap-fill.md): Managed Instance, Hyperscale, elastic pools, failover groups, the other Cosmos DB APIs and Azure DocumentDB, PostgreSQL replicas, upgrades and elastic clusters, retired database services, MySQL Bicep, and the PostgreSQL and MySQL private endpoint groupIds.