Cannot access Azure SQL database from SSMS.

Question

Cannot access Azure SQL database from SSMS.

Warren Pickell 0

I have created an Azure SQL DB with Entra ID authentication. I cannot access the database from my Windows workstation using SSMS. I need somebody to help me get all the settings set up correctly so that I have smooth access to the database from SSMS.

Erland Sommarskog 136.2K Reputation points MVP Volunteer Moderator

2026-08-05T18:43:52.3466667+00:00

So what happens when you try? Are you able to access the database with SQL authentication? If you have set up the the logical server to be Entra-only, it can still be a good idea to temporarily permit SQL authentication, so that you can verify that this works and that you are troubleshooting right thing.

2 answers

Your answer

Erland Sommarskog 136.2K Reputation points MVP Volunteer Moderator

2026-08-05T18:43:52.3466667+00:00

So what happens when you try? Are you able to access the database with SQL authentication? If you have set up the the logical server to be Entra-only, it can still be a good idea to temporarily permit SQL authentication, so that you can verify that this works and that you are troubleshooting right thing.

Answer 1

Firewall : please add your workstation's public IP under Portal then SQL Server then Networking, and confirm Public network access isn't set to Disabled.

Entra admin : set one on the server (Microsoft Entra ID blade). This is required before any Entra login will work.

Create your user (if you're not the admin): connect as the Entra admin and run this against your database, not master:

CREATE USER [******@tenant.com] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [******@tenant.com];
ALTER ROLE db_datawriter ADD MEMBER [******@tenant.com];

SSMS connection:

Server: yourserver.database.windows.net

Authentication: Microsoft Entra MFA

Username: your UserPrincipalName

Connection Properties then Connect to database: please type your DB name

SSMS 20+/21.

If this does not work then can you please post the exact error?

Answer 2

Use this SSMS setup for Azure SQL with Microsoft Entra authentication:

Open SSMS and in Connect to Server set:
- Server type: Database Engine
- Server name: <server-name>.database.windows.net
- Authentication: one of these Microsoft Entra options:
  - Microsoft Entra MFA for interactive sign-in with multifactor authentication
  - Microsoft Entra Integrated if Windows credentials are federated into Microsoft Entra ID
  - Microsoft Entra Password if signing in with a Microsoft Entra username and password
- Encryption: Strict (SQL Server 2022 and Azure SQL)
If using Microsoft Entra MFA:
- Select Microsoft Entra MFA.
- Enter the User name as ******@domain.com.
- Select Connect.
- Complete the interactive sign-in prompt.
- Connection succeeds when credentials are valid and firewall access is allowed.
If using Microsoft Entra Integrated:
- Select Microsoft Entra Integrated.
- No password is required.
- This is for Windows credentials federated into Microsoft Entra ID.
If using Microsoft Entra Password:
- Select Microsoft Entra Password.
- Enter the Microsoft Entra username as ******@domain.com.
- Enter the password.
In Connection Properties:
- Set Connect to database to the target user database name.
- This is important for Microsoft Entra authentication scenarios.
If prompted about firewall access after selecting Connect:
- Sign in and create the firewall rule.
- This is typically a one-time action.
After connection, verify success in Object Explorer by expanding the server and database objects.

If sign-in still fails, use these targeted checks:

If SSMS cannot open the browser sign-in flow for Microsoft Entra MFA, go to: Tools > Options > Azure Services > Azure Cloud and change either:
- Use system default web browser, or
- Use Web Account Manager
If access was granted recently and SSMS returns: Login failed for user '<token-identified principal>'. (Microsoft SQL Server, Error: 18456) clear the cached token in: Help > Clear Entra ID Token Cache
If using MFA and the connection still does not complete, confirm the request is not being affected by the network path. A documented case showed Global Secure Access (GSA) interfering with Microsoft Entra token authentication for Azure SQL; using a different path such as VPN or excluding Azure SQL traffic from GSA resolved the token-identified principal / 18456 failure.
If the issue is intermittent for Entra group-based access, a documented mitigation on the affected database is: DBCC FREESYSTEMCACHE('TokenAndPermUserStore') followed by DBCC FLUSHAUTHCACHE Warning: these are administrative database commands and should be used carefully on the affected database.

Recommended baseline for smooth SSMS access:

Use the latest SSMS.
Use Microsoft Entra MFA when possible.
Use Strict (SQL Server 2022 and Azure SQL) encryption.
Set the correct Connect to database value.
Ensure the Azure SQL firewall rule is created.
If access was just granted, clear the Entra token cache in SSMS before retrying.

References: