Microsoft SQL Server APIs · Authentication Profile

Sql Server Authentication

Authentication

Microsoft SQL Server APIs secures its APIs with sql-login, windows-integrated, oauth2, and mutualTLS across 0 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and authorizationCode flow(s).

Azure SQLCloud DatabaseData ManagementDatabaseMicrosoftRelational DatabaseSQL
Methods: sql-login, windows-integrated, oauth2, mutualTLS Schemes: 0 OAuth flows: clientCredentials, authorizationCode API key in:

Security Schemes

Source

Authentication Profile

Raw ↑ 
generated: '2026-06-20'
method: searched
source: >-
  https://learn.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode
  and https://learn.microsoft.com/en-us/rest/api/azure/ (Azure REST auth). No
  local OpenAPI present; profile assembled from provider auth documentation.
notes: >-
  SQL Server has two distinct authentication surfaces: (1) the database engine /
  driver connection layer (SQL logins, Windows/Kerberos, Microsoft Entra ID), and
  (2) the Azure management REST APIs (Microsoft Entra ID OAuth 2.0 bearer tokens).
summary:
  types: [sql-login, windows-integrated, oauth2, mutualTLS]
  api_key_in: []
  oauth2_flows: [clientCredentials, authorizationCode]
engine_authentication:
  docs: https://learn.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode
  modes:
  - name: SQL Server authentication
    description: Username/password logins managed inside the SQL Server instance.
  - name: Windows authentication
    description: Integrated Windows/Kerberos/NTLM authentication (Windows domains).
  - name: Microsoft Entra authentication
    description: >-
      Microsoft Entra ID (formerly Azure AD) authentication for Azure SQL and
      Azure Arc-enabled SQL Server — password, integrated, MFA/interactive,
      service principal, and managed identity.
    docs: https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview
  transport_security:
    tds_encryption: true
    strict_encryption: TDS 8.0 with TLS 1.3 (SQL Server 2025)
    mutual_tls: Client certificate authentication supported via Entra / connection encryption.
management_rest_authentication:
  docs: https://learn.microsoft.com/en-us/rest/api/azure/
  scheme:
    type: oauth2
    description: Microsoft Entra ID OAuth 2.0 bearer token in the Authorization header.
    token_endpoint_discovery: https://login.microsoftonline.com/common/.well-known/openid-configuration
    flows:
    - clientCredentials    # service principal
    - authorizationCode    # delegated user
    resource: https://management.azure.com/