Connect Azure SQL or SQL Server with Entra ID

When to use this

You want SQL Server, Azure SQL Database or Synapse behind a swarmvia endpoint and you would rather not create a SQL login at all. Microsoft's JDBC driver accepts an Entra ID access token, which swarmvia mints for an app registration. On-premises SQL Server with SQL logins works the same way with a password instead.

Setup

1. The identity

Register an application in Entra ID and create a client secret. In the database, create a contained user for it and grant it reads:

CREATE USER [swarmvia-reader] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [swarmvia-reader];

db_datareader is the boundary; narrow it with schema-level GRANT SELECT when the database holds more than the reader should see.

2. The source

Sources → New source → JDBC data source → Microsoft SQL Server / Azure SQL / Synapse. The preset fetches com.microsoft.sqlserver:mssql-jdbc from Maven Central. Placeholders: server (acme.database.windows.net), port 1433, database. The URL keeps encrypt=true.

3. The credential

OAuth 2.0 client credentials: token URL https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token, the application's client id and secret, scope https://database.windows.net/.default, token property accessToken. The driver takes a pre-minted token through accessToken alone; leave authentication unset.

For a SQL login instead, the public property user on the source and the secret property password on the credential.

4. Query

curl https://azure-sql.swarmvia.cloud \
  -H "X-Swarmvia-Key: $SWARMVIA_KEY" \
  -H "content-type: application/json" \
  -d '{"queries":[{"sql":"SELECT TOP (50) OrderID, CustomerID, OrderDate FROM Sales.Orders WHERE OrderDate >= ?","params":["2026-01-01"]}]}'

source_schema reads the driver's catalog, so schemas (Sales, dbo) and tables list the way SQL Server names them.

Tips

Entra tokens for SQL last about an hour; swarmvia refreshes before expiry and sources sharing the credential share the token.
Serverless Azure SQL resumes on the first connection after a pause; give the first query a statement timeout above the resume time.
Synapse serverless pools work with the same preset; point the server at the -ondemand endpoint.