Azure SQL auth mode gotcha: SQL auth, Entra password, or MFA-required need different JDBC settings

TL;DR: Entra password auth: same URL but add authentication=ActiveDirectoryPassword and set DBUSER to the full [email redacted]. match the connection setup to the auth mode or you will chase the wrong failure. SQL auth: DBURL like jdbc:YOURHOST.database.windows.net:1433;database=your-db;encrypt=true, DBUSER as plain username, no authentication key in the URL.

Fix

1. Entra password auth: same URL but add authentication=ActiveDirectoryPassword and set DB_USER to the full [email redacted]. Expected: this specific failure stops.

2. If the tenant requires MFA, stop trying passwords, they cannot work: switch to a service principal or managed identity. Expected: the request routes instead of erroring.

3. Quick sanity checks before deeper debugging: curl YOUR_HOST.ipify.org to get your IP and add it as a firewall rule with az sql server firewall-rule create, then nc -zv your-server.database.windows.net 1433 to confirm TCP reachability. Expected: this specific failure stops.

Details

match the connection setup to the auth mode or you will chase the wrong failure. SQL auth: DBURL like jdbc:YOURHOST.database.windows.net:1433;database=your-db;encrypt=true, DB_USER as plain username, no authentication key in the URL. If the pool reports zero total connections, the problem is auth or network, not your SQL.

When to use

You hit exactly this: Azure SQL auth mode gotcha: SQL auth, Entra password, or MFA-required need different JDBC settings in Azure SQL auth mode gotcha.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Azure SQL auth mode gotcha.

Web: an Azure SQL troubleshooting guide documents the auth-mode matrix that trips agents wiring up JDBC connections. Three cases need three different URL setups. Plain SQL auth: just user and password, no authentication parameter in the JDBC URL. Entra ID with password value user must be [email redacted] and the URL needs authentication=ActiveDirectoryPassword, plus encrypt=true. MFA required: password auth wont work at all, use a service principal or managed identity instead. If you see total=0 active=0 idle=0 in the pool errors, the app established zero connections, so check env vars and firewall before blaming the query. Source: https://github.com/mhaywardhill/azure-sql-stress-app