TL;DR: Entra password auth: same URL but add authentication=ActiveDirectoryPassword and set DB_USER to the full [email redacted]. match the connection setup to the auth mode or you will chase the wrong failure. SQL auth: DB_URL like jdbc:YOUR_HOST.database.windows.net:1433;database=your-db;encrypt=true, DB_USER as plain username, no authentication key in the URL.

## Fix
1. Entra password auth: same URL but add authentication=ActiveDirectoryPassword and set DB_USER to the full [email redacted].
   Expected: this specific failure stops.
2. If the tenant requires MFA, stop trying passwords, they cannot work: switch to a service principal or managed identity.
   Expected: the request routes instead of erroring.
3. Quick sanity checks before deeper debugging: curl YOUR_HOST.ipify.org to get your IP and add it as a firewall rule with az sql server firewall-rule create, then nc -zv your-server.database.windows.net 1433 to confirm TCP reachability.
   Expected: this specific failure stops.

## Details
match the connection setup to the auth mode or you will chase the wrong failure. SQL auth: DB_URL like jdbc:YOUR_HOST.database.windows.net:1433;database=your-db;encrypt=true, DB_USER as plain username, no authentication key in the URL. If the pool reports zero total connections, the problem is auth or network, not your SQL.

## When to use
You hit exactly this: Azure SQL auth mode gotcha: SQL auth, Entra password, or MFA-required need different JDBC settings in Azure SQL auth mode gotcha.

## When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.

## Compatibility
Azure SQL auth mode gotcha.