How to fix login failure for Azure Sql Server from Azure app service.

Error 18456 is an authentication failure, so validate and grant access to the identity actually used by App Service rather than the credentials that succeeded in Query Editor or local SSMS.

State 1 intentionally provides no detailed cause to the client; it does not identify a firewall, password, or permission issue by itself.^1^

Recommended: configure a managed-identity connection

For a .NET App Service connecting to Azure SQL Database, Service Connector can enable the system-assigned identity, create its database user and permissions, and add the passwordless connection string.^2^

Run:

az extension add --name serviceconnector-passwordless --upgrade

az webapp connection create sql \
  --resource-group <app-resource-group> \
  --name <app-service-name> \
  --target-resource-group <sql-resource-group> \
  --server <sql-server-name> \
  --database <database-name> \
  --system-identity

Then verify in the Azure portal:

1. App Service → Identity → System assigned: status must be On.
2. App Service → Configuration → Connection strings: confirm that AZURE_SQL_CONNECTIONSTRING exists.
3. Restart the App Service and test the database operation again.

The application connection string must use the Azure SQL server’s fully qualified name and the target database, for example:

{
  "ConnectionStrings": {
    "AZURE_SQL_CONNECTIONSTRING":
      "Server=tcp:<server>.database.windows.net,1433;Database=<database>;Authentication=Active Directory Default;Encrypt=True;"
  }
}

Authentication=Active Directory Default lets local execution use the developer’s Azure credential while App Service uses its assigned managed identity.^2^

Manual managed-identity setup

Use this route if Service Connector is unavailable or fails:

1. Assign the App Service identity:

az webapp identity assign \
  --resource-group <app-resource-group> \
  --name <app-service-name>

2. Ensure the Azure SQL logical server has a Microsoft Entra administrator.
3. Connect to the application database, not merely master, as that Entra administrator.
4. Create the database user and grant only the roles required by the application:

CREATE USER [<app-service-name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<app-service-name>];
ALTER ROLE db_datawriter ADD MEMBER [<app-service-name>];
GO

Add db_ddladmin only if the application must execute schema changes. These are the documented manual steps for an App Service system-assigned identity.^3^

If the application uses SQL authentication instead

Inspect the effective App Service connection string, including slot-specific settings, for the correct:

• <server>.database.windows.net hostname
• Database name
• SQL username and password
• Authentication method

Connect as an administrator and run this against master:

SELECT name, is_disabled
FROM sys.sql_logins
WHERE name = N'<application-login>';

If the login is disabled:

ALTER LOGIN [<application-login>] ENABLE;

If it does not exist, create it, then create the corresponding user in the application database and grant minimum roles:

CREATE USER [<application-user>] FOR LOGIN [<application-login>];
ALTER ROLE db_datareader ADD MEMBER [<application-user>];
ALTER ROLE db_datawriter ADD MEMBER [<application-user>];

Azure SQL’s error guidance identifies invalid credentials, disabled or missing logins, incorrect database names, and missing database-user mappings as common 18456 causes.^4^

Network checks only after authentication is corrected

The successful Query Editor and local SSMS tests establish that the database is available from those clients, but they do not test the App Service network path or identity.

If the error changes from 18456 to a connectivity/firewall error:

• Verify the connection uses the server FQDN rather than an IP address.
• For production, use App Service VNet integration with an Azure SQL private endpoint or appropriately restricted firewall rules.
• Check custom DNS/private DNS for stale records that pin the SQL hostname to an old gateway IP; Azure SQL requires the correct FQDN and dynamic gateway resolution.^4^

If it still returns State 1, enable App Service diagnostic logging and capture the UTC timestamp, SQL tracing/connection ID, effective authentication method, and username shown in the full exception for support correlation.

References

1. MSSQLSERVER_18456
2. Connect to and query Azure SQL Database using .NET and Entity Framework Core
3. Tutorial: Use managed identity to connect an Azure web app to an Azure SQL database without secrets
4. Troubleshoot connectivity issues and other errors