Can I Use Microsoft Entra ID Authentication With a VPN or SSH Tunnel?

Question

Fivetran only supports Microsoft Entra ID authentication with the Direct connection and Azure Private Link PostgreSQL connection methods. Can I use Microsoft Entra ID authentication to connect to my PostgreSQL database through a VPN or an SSH tunnel?

Environment

Connector: Azure Database for PostgreSQL flexible server
Authentication method: Microsoft Entra ID

Answer

You can use Microsoft Entra ID authentication with a network-level VPN, but not with an SSH tunnel.

A network-level VPN is transparent to Fivetran. To connect through a VPN, select Connect directly as the connection method.

However, Microsoft Entra ID authentication requires us to connect directly to the Azure-managed PostgreSQL endpoint so Azure can validate the OAuth token. An SSH tunnel routes the connection through a jump host and prevents this validation. Therefore, we only support Microsoft Entra ID authentication with the Direct and Azure Private Link connection methods, and not with Connect via an SSH tunnel.

You can use Microsoft Entra ID authentication only with the Query-Based incremental sync method. You can't use it with logical replication.

For more information, see the Azure Database for PostgreSQL setup guide and our VPN Tunnel documentation.