Connect securely to the Azure SQL Database container (least-privilege user, auth, secrets)

sa is a bootstrap/admin login for provisioning, not what your application should connect as. This skill wires the app to a least-privilege user, picks the auth method per environment (SQL locally, Microsoft Entra or managed identity in the cloud, changing only the connection string), secures the connection, and keeps the secret out of source control.

Re-measured on 2026-09-19 against the container image tag 18.0.226_4_147, reporting EngineEdition 5, Edition SQL Azure, build 12.0.2000.8. All seven executable checks behind this skill pass, and three of the numbers this skill used to print were wrong: a contained user is refused with Msg 33233 and not Msg 15007, SET CONTAINMENT = PARTIAL is refused with Msg 12824 and not Msg 12844, and CREATE USER ... FROM EXTERNAL PROVIDER on a container started without Entra configuration is refused with Msg 33134 and not Msg 37525. Each statement is still refused, so every instruction here is unchanged; only the numbers to expect are. The fixed database roles this skill grants were confirmed on the same run. The cloud side of this guidance, Azure Key Vault and managed identity, was not measured and comes from Microsoft Learn.