Azure SQL Connection

The Azure SQL connection type enables automations to query, insert, and update data in Azure SQL Database or Azure SQL Managed Instance — Microsoft's cloud-hosted SQL Server service. It is used by the plugin-sql-databases plugin, which delegates to the sql-database-connector.

Connection Type

Property	Value
Type ID	AZURE_SQL
Category	Relational Databases
Testable	Yes
Entity class	DBConnectionDetails

Friendly Example

What you enter	Example
Connection name	Azure SQL - Customer Data
Used for	Reading controlled customer records for automated compliance checks
Main details to collect	Server name, database name, username, and password
Best person to provide it	Azure or database administrator

After it is saved, workflow builders select Azure SQL - Customer Data in a node instead of entering these details again.

Connection Modes

Mode	When to use
All Details	Provide server name, port, database name, username, and password individually. The platform builds the JDBC URL automatically.
JDBC URL	Paste a full JDBC connection string directly. Useful when your DBA provides a pre-built connection string from the Azure Portal.

TLS is Mandatory

Azure SQL Database always enforces TLS encryption. The JDBC URL must include encrypt=true. Connections without it will be rejected by the Azure gateway.

Mandatory Fields

Field	What It Means	Example
host	Fully qualified server name from the Azure Portal. Found on the SQL Database Overview page under Server name.	my-server.database.windows.net
port	TCP port Azure SQL listens on. Default is 1433.	1433
database	Name of the database to connect to	customer_data
username	SQL login username. For Azure AD logins, use the format user@tenant.onmicrosoft.com.	qinfinite_automation
password	Password for the SQL login. Encrypted at rest.	••••••••

JDBC URL Format

jdbc:sqlserver://my-server.database.windows.net:1433;database=customer_data;encrypt=true;trustServerCertificate=false

Parameter	Purpose
encrypt=true	Required by Azure SQL. Enables TLS for all traffic.
trustServerCertificate=false	Validates the server certificate against a trusted CA. Set to true only in development or when using a self-signed cert on Managed Instance.
loginTimeout	Seconds to wait for a login to succeed. Defaults to 30.
applicationName	Label shown in Azure audit logs and sys.dm_exec_sessions. Useful for identifying platform-generated connections.

Example with all recommended parameters:

jdbc:sqlserver://my-server.database.windows.net:1433;database=customer_data;encrypt=true;trustServerCertificate=false;loginTimeout=30;applicationName=QinfiniteAutomation

Advanced Fields

Field	What It Means	Example
sslMode	Controls TLS validation. Use required to enforce encryption (recommended). Set to verify-full to also validate the server hostname against the certificate.	required
connectionTimeout	Maximum time in milliseconds to wait when opening a connection before failing.	15000
applicationName	Name tag sent to Azure SQL with each connection. Appears in DMVs and audit logs.	QinfiniteAutomation

Setup Instructions

1. Open the Azure Portal and navigate to your SQL Database. On the Overview page, copy the Server name (e.g., my-server.database.windows.net). The port is always 1433 unless you are using a Managed Instance with a custom port.

2. Create a SQL login with least-privilege permissions. Connect to the master database as an admin and run:

   CREATE LOGIN qinfinite_automation WITH PASSWORD = 'StrongPassword123!';

   Then switch to the target database and create the user:

   CREATE USER qinfinite_automation FOR LOGIN qinfinite_automation;
   ALTER ROLE db_datareader ADD MEMBER qinfinite_automation;
   ALTER ROLE db_datawriter ADD MEMBER qinfinite_automation;

   Grant additional roles (db_ddladmin, db_executor) only if required by your workflows.

3. Configure the firewall. In the Azure Portal, go to the SQL Server resource and select Networking. Add the Qinfinite platform's outbound IP address as an allowed firewall rule. If the platform is inside an Azure VNet, use a Virtual network rule instead.

4. Build the JDBC URL using the server name, database name, and the required encrypt=true parameter (see format above).

5. Create the connection in the Global Configurator and click Test Connection to confirm credentials and network access before saving.

Azure AD Authentication

Azure SQL also supports Azure Active Directory logins. To use Azure AD authentication, set the username to the Azure AD user's UPN (user@domain.com) and ensure the Azure AD admin is configured on the SQL Server resource. The JDBC URL should include authentication=ActiveDirectoryPassword or authentication=ActiveDirectoryMSI for managed identity scenarios.

Troubleshooting

Symptom	Likely Cause
Cannot open server requested by the login	The server name is incorrect, or the client IP is not in the Azure SQL firewall allowlist. Add the platform's IP under Networking > Firewall rules.
Login failed for user '...'	Wrong username or password, or the SQL login does not have a corresponding user in the target database. Verify both the server-level login and the database-level user exist.
The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption	encrypt=true is missing from the JDBC URL, or the Java runtime does not trust the Azure SQL TLS certificate. Ensure the JVM's truststore includes the DigiCert Global Root CA.
Connection timed out	A firewall (Azure, on-premises, or network appliance) is blocking outbound traffic on port 1433. Check all layers of network security between the platform and Azure.