Last updated: 2026-10-05

Browse Azure

Pick Azure-hosted resources straight from your signed-in Azure account instead of hand-typing cluster URLs or server hostnames. Browse Azure opens a subscription → resource kind → resource tree with live search, and fills the connection form for whatever you pick.

What it does

Finding the right endpoint for an Azure resource usually means a trip to the Azure Portal: copy the ADX cluster URI, work out the ade.applicationinsights.io proxy URL for an App Insights component, or dig the full server name out of a PostgreSQL flexible server's overview blade. Browse Azure removes that trip — Jam SQL Studio enumerates the subscriptions your Azure identity can see and lists the connectable resources in each, with live search across the tree.

Filling in a resource never auto-saves or auto-connects. Use resource populates the server, port, database, authentication, and SSL fields that resource implies; you still review, test, and save the connection yourself.

From Add Connection

Browse Azure is one of the “other ways to add” on the New Connection dialog — on its engine list, in the engine rail beside a form, and in the compact bar’s Add from… menu. It opens the picker on top of the dialog, unfiltered, with a checkbox on every resource:

• Tick one resource (or double-click a row, or press Enter on it) and Open in form opens that resource’s engine form, filled in: server, port, database, authentication, SSL — Azure SQL and Managed Instance picks set Encrypt on and Trust server certificate off; a storage account brings its endpoints and services. A draft you had open for another engine is kept; switch back to it in the rail.
• Tick two or more and the button reads Review N connections…: your picks go to the import review, on top of the dialog, where you check what to save.

Cancel returns you to exactly where you were — the same engine, values and field. Nothing is saved or connected by a pick.

On the Azure Data Explorer, SQL Server, PostgreSQL, MySQL and Azure Storage connection forms, a labeled Browse Azure button also sits next to the server field (other engines don’t show it). That picker is filtered to the form’s engine, so an ADX form only offers clusters, App Insights components, and Log Analytics workspaces, and Use resource fills the form you are on.

The tree works from the keyboard: Tab into it, Up and Down move between rows, Right and Left expand and collapse a subscription or a resource kind, Space ticks a resource, Enter opens the highlighted resource in the form.

From Import Connections

The Import… menu also lists an Azure (signed-in account) source alongside Azure Data Studio, DBeaver, and the other import sources. Choosing it opens the same picker in multi-select mode, unfiltered by engine, with cascading checkboxes at the subscription and resource-kind level — tick a whole subscription to take everything in it. Resources you already saved show as muted and pre-unchecked, and confirming sends your picks through the normal import review dialog.

Azure identity

A chip at the top of the picker shows which identity discovery is using, switchable between:

• Azure CLI — reuses whatever account you’re logged into via az login; account changes happen in a terminal and are picked up on the picker’s Refresh.
• Microsoft Entra ID — an interactive browser sign-in, with Sign in with a different account… and Sign out available from the identity menu.

Jam SQL Studio detects the Azure CLI first and falls back to Entra sign-in when it isn’t available; whichever you pick explicitly is remembered as the default next time. Enumeration only covers subscriptions visible to your active identity’s home tenant — cross-tenant guest accounts are a known limitation, called out in the picker’s empty state rather than silently omitted.

The list always belongs to the account that is signed in now. Every listing uses one Azure credential bound to that account, so pages cannot mix accounts even if you run az login as someone else while the picker is loading. After an account change (a different az login, Sign out, Sign in with a different account…) the previous account’s resources are never shown or used: the picker says “Your Azure account changed” and lists again.

Azure China, Azure US Government and custom environments

The identity menu’s Azure environment submenu lists the clouds the picker can browse: Azure (public), Azure China (21Vianet), Azure US Government, and the custom environments you added under Settings → Azure environments. The picker starts on the environment you chose last, or on your default for new connections. Each environment has its own Microsoft Entra sign-in, and a resource you pick fills the connection form with that environment (see Azure environments). With the Azure CLI identity, az must be set to the same cloud: when it is not, the picker says “The Azure CLI is set to a different Azure cloud.” and shows the command that switches it (for example az cloud set --name AzureChinaCloud, then az login), or offers the Microsoft Entra sign-in instead.

On a custom environment with the Azure Stack Hub API profile, which has no Azure Resource Graph, the picker lists storage accounts subscription by subscription through the storage resource provider; the other resource types are not listed there.

Errors, permissions and incomplete lists

Listing needs read access to the resource, its resource group or its subscription. Resources you can reach only through data roles (a storage account where you hold a data role but no Reader role, for example) do not appear — add them by URL or connection string instead. An identity that sees no subscription at all is told so before any listing runs.

Each failure is named, with the one recovery that applies:

• Session expired, multi-factor authentication required, consent required (Jam SQL Studio has not been granted access to read your resources; an administrator may have to approve) and a cancelled sign-in each offer a sign-in.
• A Conditional Access block explains that the policy (a compliant or managed device, a location, an app) has to be satisfied first — signing in again would not help, so no sign-in is offered.
• Throttled (Azure limits how often resources can be listed; the picker already retried, honouring Azure’s wait), a time limit (a listing stops after 90 seconds) and a network failure offer Retry.

Browse Azure, its sign-in and the Azure CLI it may use all go through the proxy and certificates set in Settings → Network; a proxy or certificate problem is reported as such, with Retry, instead of an expired session.

When a list is incomplete — Azure throttled a later page, the time limit hit, or the account has more resources than the picker lists — a banner above the tree says how many resources are shown and why the list is incomplete. Retry, or add a missing resource by URL or connection string.

Supported resource kinds

Security

Browse Azure never reads or writes a database password — PostgreSQL and SQL Server Authentication logins are always entered by you, the same as a hand-typed connection. Azure access itself uses your existing identity (Azure CLI session or Entra sign-in); Jam SQL Studio does not store Azure secrets of its own.

Frequently asked questions