Azure SQL Database connections and authentication — Entra-only, admins and contained users, network access, connection policy, TLS, serverless resume

How a client reaches and signs in to Azure SQL Database — Microsoft Entra-only authentication and who can turn it on, the Entra admin and contained users FROM EXTERNAL PROVIDER (and the server identity's Graph permissions), public network access, firewall rules and the Allow Azure services caveat, private endpoints, Redirect vs Proxy and their ports, TLS 1.2 minimum, serverless auto-pause and the 40613 on first connect.

markdownreferencev1DCQ3-412Tstage: designtrust: officialservice: sqlinterface: iacinterface: cliAzure SQL Database Microsoft Entra authenticationEntra-only authenticationazureADOnlyAuthenticationaz sql server ad-only-auth enableSQL Security ManagerIsExternalAuthenticationOnlyEntra adminaz sql server ad-admin createCREATE USER FROM EXTERNAL PROVIDERmanaged identity database userserver identity User.Read.All GroupMember.Read.All Application.Read.AllDirectory Readers Azure SQLpublic network access Disabledserver-level firewall ruledatabase-level firewall ruleAllowAllWindowsAzureIps 0.0.0.0DBCC FLUSHAUTHCACHEconnection policy Redirect Proxy Defaultports 11000-11999port 1433privatelink.database.windows.netminimalTlsVersion 1.2TLS 1.0 1.1 retired August 31 2025serverless auto-pauseautoPauseDelayGP_S_Gen5https://database.windows.net/.defaultMicrosoft.Sql/servers@2025-01-01server soft delete retentionDays

Created 21 Oct 2026 · Modified 23 Oct 2026 · 1 version

Azure SQL Database: connections and authentication

Sign-in: use Microsoft Entra only

  • Entra-only authentication turns off SQL authentication for everyone, including the server admin login; existing SQL logins stay but can't connect. Set the Entra admin first (a group is easiest), then az sql server ad-only-auth enable -g <rg> -n <server>, or administrators.azureADOnlyAuthentication: true at creation (Bicep in guides/sql/connect-from-typescript.md). Check from T-SQL: SELECT SERVERPROPERTY('IsExternalAuthenticationOnly') returns 1.
  • Who may toggle it: subscription Owner or Contributor, or SQL Security Manager. SQL Server Contributor can't.
  • Not supported with Entra-only on: elastic jobs, SQL Data Sync, some CDC and transactional replication scenarios, EXEC AS for Entra group members.
  • Entra admin: az sql server ad-admin create -g <rg> -s <server> --display-name <group> --object-id <group object id>. Removing it disables Entra authentication on the server.

Database users for apps

Connect as an Entra principal with ALTER ANY USER and run, in the application database (not master):

CREATE USER [<managed identity or app display name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<managed identity or app display name>];
ALTER ROLE db_datawriter ADD MEMBER [<managed identity or app display name>];
  • To resolve names, the server's identity needs Microsoft Graph User.Read.All, GroupMember.Read.All and Application.Read.All (least privilege, recommended) or the Directory Readers role. Error 33134 while creating a user usually means Conditional Access blocks Graph (00000003-0000-0000-c000-000000000000) or the caller is an app; running it as a user works.
  • WITH OBJECT_ID (preview) names the principal by object ID when display names collide.
  • Tokens are for https://database.windows.net/.default; drivers (tedious, Microsoft.Data.SqlClient) ask for it themselves.

Network path

SettingBehaviour
Public network accessLearn gives Disable as the default: only private endpoints work, and clients get 47073. With Selected networks, IP rules apply. Spec values: Enabled, Disabled, SecuredByPerimeter
Server-level IP rulesUp to 256 per server, stored in master; az sql server firewall-rule create -g <rg> -s <server> -n <name> --start-ip-address <ip> --end-ip-address <ip>. Changing rules while public access is disabled fails with 42101
Database-level IP rulesUp to 256 per database, stored in the database; Microsoft prefers them (portable, narrower)
Allow Azure servicesA 0.0.0.0 rule named AllowAllWindowsAzureIps: admits every Azure resource, including other customers' subscriptions. Off by default from the portal. Prefer private endpoints or VNet rules
Rule propagationUp to 5 minutes (immediate for contained databases without failover); DBCC FLUSHAUTHCACHE refreshes
Private endpointgroupId sqlServer, zone privatelink.database.windows.net. Public routing isn't blocked until you choose Deny public network access. Connect by <server>.database.windows.net: logins straight to the private IP or the privatelink name fail. With Redirect, allow 1433–65535 between the client and endpoint VNets, or use Proxy

Connection policy: Redirect (recommended: clients then talk to the database node directly) needs outbound 1433 to the gateways and 11000–11999 to the region's SQL addresses (use the Sql service tag); Proxy needs only 1433; Default means Redirect inside Azure and Proxy from outside. Change it with az sql server conn-policy update -g <rg> -s <server> --connection-type Redirect. The hub's reading: a client that can reach 1433 but not 11000–11999 shows up as timeouts rather than a clear error.

TLS

TLS 1.0 and 1.1 ended on August 31, 2025; since November 2024 the minimum can't be set below 1.2. Once a minimum is enforced it can't go back to "none". Clients below it get 47072 Login failed with invalid TLS version. The spec still lists None, 1.0, 1.1, 1.2, 1.3 for minimalTlsVersion: set '1.2' (or '1.3') explicitly.

Serverless

  • GP_S_Gen5_<max vCores>; autoPauseDelay in minutes (General Purpose minimum 15, default 60; -1 turns pause off).
  • The first connection to a paused database fails with 40613 and starts the resume, which usually takes under a minute: retry for at least a minute (reference/sql/errors.md).
  • Geo-replication, failover groups, long-term backup retention, a DNS alias, SQL Data Sync and elastic job databases keep the database online.

Managed Instance: reference/sql/managed-instance.md. Hyperscale, elastic pools and failover groups: reference/sql/scale-and-continuity.md.

The 2025-01-01 API also has retentionDays for soft-deleted servers (createMode: Restore); the hub hasn't found a Learn page for it yet.

Read this document as markdown — the same bytes an agent receives.