Connections, environments, and secrets
SQL Server Windows Login And Microsoft Entra
Connect with your current Windows account or sign in to Microsoft Entra in your system browser.
Prerequisites
- Install the current DataPad++ desktop pre-release and open the workspace where you want to organize your connections and saved work.
- Have access to a datastore or database file you are authorized to inspect. Start read-only with a least-privileged account.
Quickstart
- 1
Choose the authentication method
Create or edit SQL Server and choose SQL login, Windows — current account (Windows only), or Microsoft Entra — browser sign-in. Windows login uses OS Negotiate (Kerberos, with NTLM only when policy allows), not forced NTLM. Prefer the server’s fully qualified DNS name; domain trust, SPNs and database permissions must be configured by your administrator. Authentication is independent of TCP, named-instance or Azure SQL transport. No Windows password is collected.
- 2
Prepare your organisation’s registration
For Entra, an administrator supplies tenant and application client IDs, a public desktop registration with http://localhost redirect, Azure SQL Database delegated user_impersonation permission and consent. Configure the database’s Entra administrator and grant the user database access. No client secret is needed.
- 3
Sign in in the system browser
Choose Sign in and complete account selection and MFA. Cancel sign-in stops waiting; the request otherwise expires after five minutes. Device-compliance policies requiring an OS broker are unsupported. Sign-in never starts automatically during background loading or query execution.
- 4
Choose session-only or protected remembering
Remember this account is unchecked by default. Remembered sessions use Windows protection, macOS Keychain or Linux Secret Service, never plaintext storage, workspace files or exports. If secure storage is unavailable, use session-only sign-in. Each workspace, connection, environment, tenant and client has its own selected account.
- 5
Test database access separately
Saving a profile does not connect. A completed sign-in survives saving the same account binding; changing tenant, application or environment requires signing in again. Choose Test connection to verify database access. Entra requires encryption and certificate validation; correct certificate trust and hostnames rather than bypassing them.
- 6
Change or remove the selected account
Change account opens the Microsoft account selector. Sign out removes only this DataPad++ binding. When tokens cannot renew silently, return to the editor and sign in; queries and writes are never automatically replayed.
Task and control reference
- Windows authentication requires domain/server configuration and is not universally available on Azure SQL. Entra Integrated/WAM, cross-platform Kerberos, alternate Windows credentials, device-code flow, service principals, certificates, managed identities and sovereign clouds are outside this release.
Registration and troubleshooting reference
Safety boundaries
Troubleshooting
| Symptom | What to check |
|---|---|
| A control is disabled | Read its disabled reason, then verify target scope, connection health, read-only mode, environment policy, and feature maturity. |
| The screen does not match this guide | Confirm the app version and platform, refresh the active tab, and check whether the feature is marked Experimental, Plan only, or Unavailable. |
| The operation produces no rows | Open Messages and History, verify the selected datastore scope, replace the sample object names with names from your datastore, and retry with a bounded read. |