Postgres Flex with Entra-Only Auth: Eliminating the Built-In Admin

Most Postgres deployments still ship with a long-lived admin password sitting in Key Vault, rotated every 90 days, and used by exactly nobody except the on-call who forgot it. Azure Database for PostgreSQL Flexible Server now lets you skip the password entirely.

Create with Entra-only auth

az postgres flexible-server create `
  -g rg-app-prod-swc-001 -n psql-app-prod-swc-001 `
  --tier Burstable --sku-name Standard_B1ms --version 16 `
  --microsoft-entra-auth Enabled `
  --password-auth Disabled `
  --active-directory-auth Enabled `
  --admin-object-id $myObjectId `
  --admin-display-name $myUpn `
  --admin-type User `
  --public-access None

That last line — --public-access None — combined with a private endpoint means the server has no public IP. Combined with --password-auth Disabled, no password exists to leak.

Adding application identities

Once bootstrap admin (you) can connect, create database roles backed by Entra groups, then assign apps' managed identities to those groups. From the app side it's:

cred = DefaultAzureCredential()
token = cred.get_token("https://ossrdbms-aad.database.windows.net/.default")
conn = psycopg.connect(host=..., user=app_identity_name, password=token.token)

Token lifetime is 60-90 minutes. Refresh on connection error. No secrets in app config, no passwords in Key Vault, no rotation runbooks.

What you give up

Some legacy tooling (older psql clients, certain ORMs) doesn't support the token-as-password trick. Test before committing. If you must support them, enable both auth types initially and migrate clients piecewise.