Entra ID auth & Azure discovery

◐ in progress

Azure SQL should not require a scavenger hunt for credentials and firewall rules. Sign in with Entra ID, discover the servers and databases you can reach, and get help adding a firewall rule when Azure turns you away at the door.

Signing in

Entra (browser) - the normal interactive flow, including whatever conditional access and MFA your tenant requires.
Entra (device code) - for a machine where opening a browser is awkward: SQLly shows a code, you complete sign-in elsewhere.

Tokens are acquired and refreshed for you, and more than one Entra account can be registered at a time - which is the normal state of affairs if you work across a customer tenant and your own.

Not only Azure. The same token-on-connect pattern covers AWS RDS / Aurora IAM (a short-lived SigV4 token minted from your local AWS credentials) and Google Cloud SQL IAM (an OAuth token from Application Default Credentials). In all three cases the “password” is minted fresh at connect time and never stored.

Discovery, cached so it is there on launch

SQLly asks Azure Resource Manager which SQL servers and databases your accounts can see, across subscriptions, and shows them in the explorer. Because that is an authenticated network round-trip, a cold launch would otherwise leave the tree empty for the first few seconds - so every successful discovery is saved as a local snapshot and reloaded instantly on the next launch.

Azure is re-contacted only when you ask: refreshing an Azure node, adding or removing an Entra account, or signing in again. A stale or corrupt cache never blocks startup; it simply yields nothing until a refresh.

Firewall assist

Azure SQL rejects an unknown client IP with error 40615, and the message contains the address it blocked. SQLly recognises that specific failure, extracts the IP, matches the server against your discovered ARM servers, and offers to add the firewall rule - rather than leaving you to translate a login error into a portal visit.

In progress. Sign-in, discovery with its cache, and firewall-block detection work today; some of the rule-creation and multi-tenant edges are still being smoothed.