Microsoft SQL Server

Connect to SQL Server and Azure SQL Database with the FreeTDS-based driver plugin

Named instances are not supported. Give the host and the TCP port, 1433 by default, and let the Authentication dropdown decide the rest of the form: a SQL Server login, a Kerberos ticket from your domain, or a Microsoft Entra ID work account. The protocol underneath is TDS 7.4, which every server from 2012 on speaks, so Windows, Linux, Docker and Azure SQL Database are all reachable.

The driver is not in the app. Picking in the Choose a Database sheet offers the download before the form opens, and opening a saved connection installs it without asking. Settings > Plugins > Browse > installs it up front. See Plugins.

Quick setup

Click Create Connection…, select SQL Server, fill in the fields, then click Save & Connect. For Azure SQL Database, use yourserver.database.windows.net and an SSL mode of Required (skip verify) or stricter.

Field	Default	Notes
Host	localhost	A hostname, or an IP for anything but Kerberos
Port	1433
Authentication	SQL Server Authentication	Or Windows Authentication (Kerberos), or Microsoft Entra ID
Username	-	The SQL Server login. Hidden under the other two methods
Database	-	Optional, sent during login when set. Required for a login scoped to one database, such as an Azure SQL contained user
Schema	dbo	Selected after connecting. Clear it to take the login’s own default

SQL Server connection form

Connection URL

sqlserver://user:password@host:1433/database
mssql://user:password@host:1433/database

See Connection URL Reference for all parameters.

Windows Authentication (Kerberos)

On macOS, Windows Authentication means Kerberos. Set Authentication to Windows Authentication (Kerberos), then either leave Kerberos Principal and Password blank to use the ticket in your credential cache, or enter [e-mail] and your domain password to have one requested at connect. Get a cached ticket with kinit [e-mail]; klist shows it.

Four things have to hold:

• Connect by hostname, never an IP address. Kerberos targets the service principal name MSSQLSvc/host.domain.com:1433, registered against the host name.
• Write the realm in uppercase, usually the DNS domain: CONTOSO.COM.
• This Mac has to reach the domain’s KDC, through DNS SRV records or /etc/krb5.conf.
• The SQL Server service account has to own that SPN. Your administrator registers it.

For a server in a realm other than your default_realm, map its DNS domain and the ticket is requested there instead:

[domain_realm]
  .sql.example.com = RESOURCE.REALM.COM

A host with no [domain_realm] entry falls back to default_realm. TablePro never runs kinit or edits /etc/krb5.conf.

Microsoft Entra ID

Set Authentication to Microsoft Entra ID to sign in with a work account instead of a SQL Server login: Azure SQL Database, Azure SQL Managed Instance, and SQL Server 2022 with Entra authentication enabled.

Field	Notes
Application (Client) ID	The application registration TablePro signs in as. Required
Directory (Tenant) ID	Your directory ID or domain. Blank uses the multi-tenant organizations authority

1. Register an application

   In the Azure portal, under App registrations, add one with platform Mobile and desktop applications, Allow public client flows set to Yes, and the delegated permission Azure SQL Database → user_impersonation.

2. Create the database user

   CREATE USER [[e-mail]] FROM EXTERNAL PROVIDER;
   ALTER ROLE db_datareader ADD MEMBER [[e-mail]];
   
3. Sign in

   Fill in the two fields and click Test Connection. A one-time code goes to the clipboard and your browser opens on the sign-in page. Paste it, approve, then test again.

The device code flow honors multifactor authentication and Conditional Access. Tokens land in your login keychain marked device-only, so they never travel through iCloud Keychain, and the access token refreshes in the background. You sign in again only when the refresh token expires or is revoked.

A sign-in that succeeds and is then refused by the database means no database user matches the token. Run CREATE USER … FROM EXTERNAL PROVIDER against the database you are opening.

Databases and schemas

The sidebar nests tables under their schema, hides the built-in role schemas (db_owner, guest, and the rest), and marks master, tempdb, model and msdb as system databases. Press Cmd+K to change database: the switch happens in place, with no reconnect. Opening a table queries it in the schema it is listed under, so a table outside dbo needs no switch first.

INSERTs from the data grid leave IDENTITY columns out, so the server assigns them, and TEXTSIZE is raised at connect, so nvarchar(max) and text values arrive whole rather than cut to FreeTDS’s 2048-byte default.

SSL/TLS

New connections start on Preferred.

Mode	Behavior
Disabled	Plain TCP
Preferred	TLS, falling back to plain when the server cannot
Required (skip verify)	TLS, certificate unchecked
Verify CA	TLS, certificate chained to a trusted authority
Verify Identity	TLS, chain checked, and the certificate names the host you dialled

Verification runs against the macOS system roots at /etc/ssl/cert.pem, which covers Azure SQL and anything else publicly trusted. See SSL/TLS.

SQL Server connections can also run through the Cloud SQL Auth Proxy, which TablePro starts and stops for you.

Limitations

• Named instances are not supported. Give the host and the TCP port that instance listens on.
• NTLM is not supported: Windows Authentication on macOS is Kerberos only.
• Entra ID connections are created on the Mac only, through the device code flow only. iPhone and iPad take them over sync and prompt to sign in when you open one.
• The SSL pane offers no certificate fields here. Verification runs against the system trust store; a private trust anchor goes in your own freetds.conf.

Troubleshooting

Failed to connect to host:1433: …

The tail is FreeTDS’s own message. Nothing listening means TCP/IP is off in SQL Server Configuration Manager, the service is down, or port 1433 is closed. A rejected login means the credentials, or a server that takes Windows Authentication only: SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') returns 1 for that, and mixed mode goes on in SSMS under Server Properties > Security. A login scoped to one database, an Azure SQL contained user for instance, needs Database filled in; without it the server authenticates against master and refuses.

No Kerberos ticket was found.

There is no ticket in the credential cache. Run kinit [e-mail], or fill in Kerberos Principal and Password, then reconnect.

Server not found in Kerberos database

Reported as The SQL Server Kerberos service principal name is not registered. The server has no SPN, or has one in a realm this Mac does not map the host to. Ask your administrator to register MSSQLSvc/host.domain.com:1433, connect by hostname rather than IP, and add a [domain_realm] entry for a cross-realm server.

This Mac’s clock is too far out of sync with the domain controller.

Turn on Set time automatically in System Settings > General > Date & Time, then reconnect.

Set the Microsoft Entra ID application (client) ID for this connection.

The connection carries no client ID. Fill in Application (Client) ID.

The Microsoft Entra ID sign-in timed out before it was approved.

The one-time code expired first. Click Test Connection to start a new one.

AADSTS7000218

The app registration does not allow public client flows, which the device code flow needs. Turn it on in the Azure portal.

Related

• SSL/TLS
• SSH Tunneling
• Work on Several Databases at Once