Originally published at SQL & Cloud Lab .

This post was drafted with AI assistance.

Connection strings with a SQL username and password end up in config files, pipelines and sometimes source control. With a managed identity , your Azure-hosted .NET app signs in to Azure SQL using Microsoft Entra ID (formerly Azure AD) and gets tokens automatically. There is no secret to store, rotate or leak.

How it works

Azure gives your App Service, Function App, container or VM an identity in Microsoft Entra ID. Your code asks for a token for that identity, and SQL Server accepts the token instead of a password. The client library handles token caching and renewal for you.

Step 1: enable the identity on your app

In the Azure portal, open your App Service (or Function App), go to Identity , and switch System assigned to On . Azure creates an identity with the same name as the app.…