SQL Server or Azure SQL agent fails to authenticate to Azure SQL Database using Azure Active Directory (AAD) (Microsoft Entra Password) Authentication due to "Connection timed out" (4380947)

SQL Server or Azure SQL agent fails to authenticate to Azure SQL Database using Azure Active Directory (AAD) (Microsoft Entra Password) Authentication due to "Connection timed out"

SQL Server or Azure SQL agent fails to authenticate to Azure SQL Database using Azure Active Directory (AAD) (Microsoft Entra Password) Authentication due to "Connection timed out" 

The Foglight Agent Manager (FglAM) runs on Java and does not inherit Windows proxt settings. When using AAD authentication, the agent must reach Microsoft Entra ID endpoints (e.g., login.microsoftonline.com) over HTTPS to get an authentication token. If the JVM is not configured for the corporate proxy, or the proxt blocks HTTPS tunneling, the connection fails with a Connection timed out error.

 

Why SSMS Works and Foglight/MSAL4J Fails

The two applications use different network stacks which are configured via different methods:

 

Application / Component	Technology Stack	Proxy Configuration Method
SSMS	Microsoft .NET / Windows	Uses to Windows system settings (WinInet) or the .NET configuration file (machine.config) to inherit Windows proxy settings automatically
SQL Server or Azure SQL agent (MSAL4J)	Java Virtual Machine (JVM)	Runs in the JVM which doesn't inherit the Windos proxy settings. The proxy must be explicitly configured using JVM system properties (-DproxyHost} in the baseline.jvmargs.config

 

To summarize, SSMS is told by Windows, "use this proxy." The FglAM, running in a Java sandbox, is essentially oblivious to the Windows setting and attempts a direct connection, which your firewall blocks, leading to a Connection Timeout.

Ensure that the correct username and password is entered into the database agent

Check the Username, in most cases it should be the UPN, like username@domain.com, not DOMAIN\USERNAME

 

Configuration to Make MSAL4J Work

1. Configure the proxy in the JVM 

Add these parameters to baseline.jvmargs.config on the Foglight Agent Manager (FglAM):

-Dhttp.proxyHost=proxy.company.com
-Dhttp.proxyPort=8080
-Dhttps.proxyHost=proxy.company.com
-Dhttps.proxyPort=8080


If the proxy requires authentication:

-Dhttp.proxyUser=my_proxy_user
-Dhttp.proxyPassword=mypassword

 

Optional for Java 11+ with Basic Auth proxies:

-Djdk.http.auth.tunneling.disabledSchemes=
-Djdk.http.auth.proxying.disabledSchemes=

(The empty value after the eauals sign means allow all schemes)

 

Important:

• Include both http and https properties
• Do not include http:// or https:// in *.proxyHost.
• Remove any spaces around = in the properties

 

2. Verify Proxy Allows HTTPS Tunneling

Run this PowerShell test from the FglAM host:

Invoke-WebRequest -Uri "https://login.microsoftonline.com" -Proxy "http://proxy.company.com:8080" -TimeoutSec  

Expected result: StatusCode = 200 or 302.

If it fails, the proxy must allow HTTP CONNECT for HTTPS traffic.

3. Confirm Firewall Rules

 

4. Restart FglAM

 

Workarounds

• Bypass Proxy for AAD Domains:
  -Dhttp.nonProxyHosts="login.microsoftonline.com|login.windows.net|aadcdn.msftauth.net"
• Move Agent to a network with direct HTTPS access
• Proxy Bypass or Firewall Exceptions: for AAD endpoints. This can be done using PAC files, proxy configuration policies, or firewall rules that exclude these domains from proxy interception.
  • login.microsoftonline.com
  • login.windows.net
  • aadcdn.msftauth.net

References:
Microsoft Entra Hybrid Join Requirements