Sign Up
Docs
All Guides

Step-by-step Atlas walkthroughs

Databases

Database-specific Atlas guides

Setting up CI/CD

Wire Atlas into your pipeline

ORMs and Frameworks

Integrate Atlas with any ORM

Shift Left Database Security

Roles, permissions, and policies as code

Seed Data as Code

Lookup tables and reference data

Deploying on Kubernetes

Run via the Atlas Operator

Terraform Provider

Manage schemas via Terraform

Database Governance

End-to-end control and compliance

Schema Drift Detection

Block drift before and after deploys

AI-Safe Database Changes

Safe schema changes at machine speed

Modernize Schema Migrations

Apply modern CI/CD to schema changes

Standardize Schema Migrations

One migration tool to rule them all

Database per tenant

Manage thousands of databases as one

PRICING
Sign InSign Up
Back to changelog
New
•2 minute read

Azure: Microsoft Entra Token Data Source

The new azure_db_token data source mints a short-lived Microsoft Entra access token for Azure Database for PostgreSQL and MySQL from inside the project file, so the connection URL no longer carries a static password.

Atlas can now mint a short-lived Microsoft Entra access token for Azure Database for PostgreSQL and MySQL directly from the project file. The new azure_db_token data source resolves credentials through the Azure SDK default chain: environment variables, workload identity, managed identity, or an Azure CLI login. The connection URL no longer carries a static password.

The data source is part of Atlas Pro. Run atlas login to create an account or start a free trial. Without a login it fails with data.azure_db_token.db: requires 'atlas login'.

Declaring the Data Source

Declare the block and reference it where the password belongs. The Entra user contains @, so it must be URL-escaped with urluserinfo (or urlescape) rather than interpolated into the URL string:

atlas.hcl
data "azure_db_token" "db" {}


env "azure" {
  # The Entra user contains "@", so it must be URL-escaped
  # with urluserinfo (or urlescape) rather than interpolated.
  url = urluserinfo(
    "postgres://myserver.postgres.database.azure.com:5432/postgres?sslmode=require",
    "app@contoso.onmicrosoft.com",
    data.azure_db_token.db,
  )
}

Arguments

Both attributes are optional. Set them to authenticate against a specific tenant, or to request a token for a different resource:

atlas.hcl
data "azure_db_token" "db" {
  tenant_id = "00000000-0000-0000-0000-000000000000"
  scope     = "https://token.postgres.cosmos.azure.com/.default"
}

tenant_id defaults to the tenant of the signed-in identity. scope defaults to https://ossrdbms-aad.database.windows.net/.default, the resource shared by Azure Database for PostgreSQL and MySQL. Use https://token.postgres.cosmos.azure.com/.default for Azure Cosmos DB for PostgreSQL.

The token is minted once per set of arguments and reused for the rest of the run, so several environments sharing one data block cost one call. For the other data sources available in the project file, see Data Sources.

featureazurepostgresmysqlauth-tokenhcl
Back to changelog