Quickstart: Choose a Microsoft SQL security sample

Use these Microsoft SQL security samples to compare how Data API builder (DAB) authenticates to SQL, validates users, and enforces per-user access. Each sample is self-contained, but the series moves from basic credentials to user-delegated Azure SQL access.

Choose a quickstart

Start with the question that matches your goal.

Decision tree

• Do you only need a basic working sample?
  • Use Username/password.
• Do you want passwordless DAB-to-Azure SQL access?
  • Use Managed identity.
• Do you need DAB to validate Microsoft Entra tokens?
  • Use Microsoft Entra.
• Do signed-in users need to see only their own rows?
  • If DAB should enforce the filter, use DAB policies.
  • If SQL should enforce the filter, use SQL row-level security.
• Do audit logs or database policies need the actual signed-in user as the SQL identity?
  • Use On-behalf-of to Azure SQL.

Compare the security model

The DAB authentication provider column shows the effective value for runtime.host.authentication.provider. If the configuration omits this setting, DAB uses Unauthenticated. Except for the username/password and on-behalf-of samples, local runs use SQL credentials and Azure deployments use managed identity. The on-behalf-of sample also sets data-source.user-delegated-auth.provider to EntraId.

Related content

• Quickstart: Use Data API builder with SQL
• Microsoft Entra ID authentication in Data API builder
• Authorization overview
• Configure on-behalf-of authentication