Azure Database for MySQLAuthorCloudBrum editorial teamLast reviewed29 Oct 2026Reading time~12 minLevelBeginner to advanced

• Community MySQLIt’s MySQL, so applications, drivers and tools that speak MySQL work as they do elsewhere. That includes the frameworks and content systems that default to it.
• Current versionsMySQL 8.0 and 8.4 are the supported versions. 5.7 has reached the end of community support and can only be kept on paid extended support while you plan the upgrade.
• Three compute tiersBurstable for development and light use, General Purpose for most production applications, and Business Critical for heavier, memory-hungry workloads.
• High availabilityTurn on same-zone or zone-redundant high availability and Azure keeps a synchronised standby that takes over if the primary fails. It isn’t available on the Burstable tier, and the zone-redundant option is chosen when the server is created.
• Backups and point-in-time restoreBackups run on a schedule and are kept for up to 35 days. A restore creates a new server at the moment you choose.
• Read replicasUp to ten replicas copy the data asynchronously, in the same Region or another, to serve reads or to act as a disaster recovery copy.
• I/O you can raise separatelyYou can buy more IOPS without buying more storage, and let the server scale IOPS automatically, which helps with bursts of traffic.
• Private by designPrivate access places the server inside your virtual network. Connections use TLS 1.2 by default, and Microsoft Entra sign-in can replace stored passwords.

Flexible server

Microsoft’s present-day packaging of the service. Single Server, its predecessor, has gone.

Compute tier and SKU

Burstable, General Purpose or Business Critical, plus a size such as Standard_D2ds_v4. It decides vCores, memory and the connection limit.

Storage and IOPS

A provisioned disk that can grow but not shrink. The server includes some IOPS with the storage, and you can add more.

High availability

A standby in the same zone or in another zone, kept in step with the primary. It doesn’t answer queries.

Read replica

An asynchronous, read-only copy that can be promoted to a stand-alone server.

Private access

A private address inside a subnet you set aside in your own network. Applications find it by name through a private DNS zone.

Public access

An internet-facing name guarded by a list of the addresses that are allowed in.

Server parameter

A MySQL setting, such as max_connections or require_secure_transport. Some need a restart.

lower_case_table_names

A setting that decides whether table names are case sensitive. It can only be chosen when the server is created.

Extended support

A paid arrangement that keeps an out-of-support MySQL version patched while you migrate.

Microsoft Entra authentication

Sign-in with an Entra identity and a short-lived token. It needs a user-assigned managed identity on the server and an Entra administrator.

Point-in-time restore

Builds a new server from the backups and logs at a chosen moment, leaving the original untouched.

Maintenance window

The monthly period you pick for patches that restart the server.

Geo-redundant backup

A copy of backups in the paired Region, set when the server is created.

Set up a private MySQL server through the Azure portal

1. Pick the Region and the network modeDecide where the server lives and how it’s reached. Central India suits many Indian teams. Private or public access is locked in when you create the server, and private access wants a virtual network in the same Region.
2. Start the wizardFind Azure Database for MySQL flexible servers in the portal and press Create. Fill in the subscription, resource group and a server name nobody else uses, and take MySQL 8.4 or 8.0 rather than 5.7.
3. Choose the workload sizeUse the Development preset for a small Burstable server, or General Purpose for production. Start with two or four vCores and resize from measurements.
4. Turn on high availability if it’s productionChoose zone-redundant (or same-zone if the Region has no zones). It roughly doubles compute and storage cost, and it isn’t offered on Burstable. Zone-redundant HA has to be chosen now.
5. Set the storage and IOPSPick the storage size, tick autogrow, and look at the IOPS included. Raise IOPS separately later if monitoring shows I/O is the limit.
6. Choose authenticationCreate the administrator account for MySQL authentication, and plan to add Microsoft Entra authentication so applications don’t use stored passwords. Entra sign-in needs a user-assigned managed identity.
7. Choose private accessUnder Networking choose Private access, then point it at a virtual network, a subnet reserved for the service and a private DNS zone. Should you need public access instead, allow named addresses and nothing wider.
8. Set backups and the table-name settingChoose the backup retention, geo-redundant backup if needed, and the case-sensitivity of table names, which can’t be changed afterwards.
9. Connect and testConnect from inside the network over TLS, create an application user with limited privileges, load a little data and test a point-in-time restore before you rely on the backups.

• Let monitoring set the size: watch CPU, memory, IOPS and open connections, and leave Burstable once credits keep running out.
• Raise IOPS separately, or let the server scale it, when I/O is the limit, instead of buying more storage you don’t need.
• Use connection pooling in the application or framework, since max_connections depends on memory.
• Send read traffic to replicas, and watch lag, so reports don’t compete with writes.
• Use the slow query log and EXPLAIN to find missing indexes, and fix queries before scaling up.
• Keep the InnoDB buffer pool warm and large enough for the working set by choosing a tier with enough memory.
• Keep transactions short and avoid long-running idle ones that hold locks.
• Run the web tier in the same Region and zone as the database to cut round-trip time.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Azure Database for MySQL.

• Stop non-production servers overnight and at weekends. Compute charges pause, storage keeps billing, and Azure turns a stopped server back on after the maximum stop period.
• Run dev, test and small sites on Burstable, and production on General Purpose.
• Skip high availability outside production, where it would roughly double the bill.
• Consider reserved capacity for servers that are sure to run for a year or longer.
• Keep backup retention in line with recovery needs: backup space up to the size of your storage costs nothing, and anything beyond that is billed.
• Don’t over-provision IOPS. Pay for more only after metrics show I/O is the bottleneck, and consider autoscaling IOPS.
• Remove replicas and restore-test servers once the exercise is over.
• Upgrade off MySQL 5.7 before extended support fees start to matter.
• Tag servers with owner and environment, then set budgets and alerts in Cost Management.
• Check whether your free account includes a small MySQL server for your first year.

• Choose private access, or a private endpoint, and keep any public firewall rules to specific addresses.
• Keep TLS required (require_secure_transport on, TLS 1.2 or newer) and have clients verify the server certificate.
• Turn on Microsoft Entra authentication with a user-assigned managed identity, and move applications off stored MySQL passwords.
• Create separate MySQL users per application with privileges limited to its schema, and keep the administrator account for administration only.
• Where policy demands it, hold the encryption key yourself in Key Vault, with soft delete and purge protection on the vault.
• Turn on the audit log and send diagnostic logs to Log Analytics, and alert on failed logins and changes to server parameters.
• Let Azure Policy insist on private access, TLS and tags, and read Defender for Cloud’s posture findings.
• Restrict who can change networking, parameters and deletion with Azure RBAC, and add resource locks to production servers.
• Plan upgrades off versions that are out of standard support, and test them on a restored copy.
• Review users and grants regularly, and remove accounts that no application uses.

Use the Activity log and Azure Monitor to see who changed what, Azure Policy for the rules above, Defender for Cloud for posture and the Service Trust Portal for compliance reports. Microsoft operates the platform and patches MySQL. You answer for what’s in the database, who holds which grants, how exposed the network is and whether recovery has really been tried.

• Stop dev and test servers outside working hours, since a stopped server uses no compute.
• Right-size compute and storage. Spare capacity still draws power.
• Use replicas only where reads need them, and delete them afterwards.
• Add the right indexes and cache hot reads so each request does less work.
• Don’t keep backups longer than recovery requires.
• For work that isn’t tied to a location, a Region on a cleaner grid is worth considering if your data rules allow it.
• Microsoft’s Emissions Impact Dashboard breaks emissions down by subscription; find out how it counts databases before relying on a figure.

Purchase options

What you actually pay for

• Compute for every hour the server runs, by tier and size, doubled when HA is on
• The provisioned disk, plus IOPS beyond what’s included
• Backups past the free allowance, longer retention and geo-redundant copies
• Each read replica, charged like a server
• Extended support for retired versions, cross-Region traffic and Log Analytics

The orders database on Azure Database for MySQL: a private server with zone-redundant high availability, 14 days of backups and Microsoft Entra sign-in, plus a read replica and a restore test. Build it with the CLI or Terraform tab. The Python and C# tabs sign in with an Entra token over verified TLS and insert an order in a transaction. Names, the Entra administrator and the subscription are examples, and the Terraform tab keeps the administrator password as a variable you should source from a secret store. Billing for a zone-redundant server starts at creation, so remove the test server when you finish.

# Names are examples; the server name must be unique across Azure.
RG=rg-orders-mysql
LOCATION=centralindia
SERVER=orders-mysql-001
ADMIN_ID=00000000-0000-0000-0000-000000000000   # object ID of the Entra user or group that administers the server

az group create --name $RG --location $LOCATION

# Entra sign-in needs a user-assigned managed identity on the server
az identity create --resource-group $RG --name mi-orders-mysql
IDENTITY_ID=$(az identity show --resource-group $RG --name mi-orders-mysql --query id --output tsv)

# A private, zone-redundant MySQL 8.4 server. This also creates the virtual network, the delegated subnet and the private DNS zone.
# The CLI prints a generated administrator password if you don't supply one: keep it in a secret store.
az mysql flexible-server create --resource-group $RG --name $SERVER --location $LOCATION \
  --version 8.4 --tier GeneralPurpose --sku-name Standard_D2ds_v4 \
  --storage-size 128 --storage-auto-grow Enabled \
  --high-availability ZoneRedundant --zone 1 --standby-zone 2 \
  --backup-retention 14 --geo-redundant-backup Disabled \
  --vnet vnet-orders --address-prefixes 10.40.0.0/16 \
  --subnet snet-mysql --subnet-prefixes 10.40.1.0/24 \
  --private-dns-zone orders.private.mysql.database.azure.com \
  --identity $IDENTITY_ID --database-name orders \
  --tags owner=orders-team --yes

# Make an Entra group the administrator
az mysql flexible-server ad-admin create --resource-group $RG --server-name $SERVER \
  --display-name orders-db-admins --object-id $ADMIN_ID --identity $IDENTITY_ID

# Keep connections encrypted (this is the default; stating it makes the intent visible)
az mysql flexible-server parameter set --resource-group $RG --server-name $SERVER --name require_secure_transport --value ON

# A read replica for reporting
az mysql flexible-server replica create --resource-group $RG --replica-name orders-mysql-replica --source-server $SERVER

# Practise the restore: a new server from the backups, at a time you choose (UTC)
az mysql flexible-server restore --resource-group $RG --name orders-mysql-restore-test \
  --source-server $SERVER --restore-time "2026-10-29T08:30:00Z"

# Clean up the test copy
az mysql flexible-server delete --resource-group $RG --name orders-mysql-restore-test --yes

# Assumes the azurerm provider 4.x. The administrator password is a variable: fetch it from a secret store, never commit it.
provider "azurerm" {
  features {}
}

variable "admin_password" {
  type      = string
  sensitive = true
}
variable "admin_object_id" { type = string }   # object ID of the Entra administrator

data "azurerm_client_config" "current" {}

resource "azurerm_resource_group" "orders" {
  name     = "rg-orders-mysql"
  location = "centralindia"
}

resource "azurerm_virtual_network" "orders" {
  name                = "vnet-orders"
  location            = azurerm_resource_group.orders.location
  resource_group_name = azurerm_resource_group.orders.name
  address_space       = ["10.40.0.0/16"]
}

resource "azurerm_subnet" "mysql" {
  name                 = "snet-mysql"
  resource_group_name  = azurerm_resource_group.orders.name
  virtual_network_name = azurerm_virtual_network.orders.name
  address_prefixes     = ["10.40.1.0/24"]

  delegation {
    name = "mysql"
    service_delegation {
      name    = "Microsoft.DBforMySQL/flexibleServers"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "azurerm_private_dns_zone" "mysql" {
  name                = "orders.private.mysql.database.azure.com"
  resource_group_name = azurerm_resource_group.orders.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "mysql" {
  name                  = "orders-mysql-link"
  resource_group_name   = azurerm_resource_group.orders.name
  private_dns_zone_name = azurerm_private_dns_zone.mysql.name
  virtual_network_id    = azurerm_virtual_network.orders.id
}

resource "azurerm_user_assigned_identity" "mysql" {
  name                = "mi-orders-mysql"
  location            = azurerm_resource_group.orders.location
  resource_group_name = azurerm_resource_group.orders.name
}

resource "azurerm_mysql_flexible_server" "orders" {
  name                   = "orders-mysql-001"
  resource_group_name    = azurerm_resource_group.orders.name
  location               = azurerm_resource_group.orders.location
  version                = "8.0.21"
  sku_name               = "GP_Standard_D2ds_v4"
  zone                   = "1"
  administrator_login    = "mysqladmin"
  administrator_password = var.admin_password

  delegated_subnet_id = azurerm_subnet.mysql.id
  private_dns_zone_id = azurerm_private_dns_zone.mysql.id

  backup_retention_days        = 14
  geo_redundant_backup_enabled = false

  storage {
    size_gb           = 128
    auto_grow_enabled = true
  }

  high_availability {
    mode                      = "ZoneRedundant"
    standby_availability_zone = "2"
  }

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.mysql.id]
  }

  tags = { team = "orders" }

  depends_on = [azurerm_private_dns_zone_virtual_network_link.mysql]
}

resource "azurerm_mysql_flexible_database" "orders" {
  name                = "orders"
  resource_group_name = azurerm_resource_group.orders.name
  server_name         = azurerm_mysql_flexible_server.orders.name
  charset             = "utf8mb4"
  collation           = "utf8mb4_0900_ai_ci"
}

resource "azurerm_mysql_flexible_server_active_directory_administrator" "admin" {
  server_id   = azurerm_mysql_flexible_server.orders.id
  identity_id = azurerm_user_assigned_identity.mysql.id
  login       = "orders-db-admins"
  object_id   = var.admin_object_id
  tenant_id   = data.azurerm_client_config.current.tenant_id
}

resource "azurerm_mysql_flexible_server_configuration" "secure_transport" {
  name                = "require_secure_transport"
  resource_group_name = azurerm_resource_group.orders.name
  server_name         = azurerm_mysql_flexible_server.orders.name
  value               = "ON"
}

# pip install mysql-connector-python azure-identity
# One-off, as the Entra administrator:  CREATE AADUSER 'orders-app' IDENTIFIED BY 'orders-app-client-id';
#                                        GRANT SELECT, INSERT ON orders.* TO 'orders-app'@'%';
import time

import mysql.connector
from azure.identity import DefaultAzureCredential

HOST = "orders-mysql-001.mysql.database.azure.com"   # with private access this name resolves to a private address
DB_NAME = "orders"
DB_USER = "orders-app"                                # the Entra principal's name in MySQL
CA_FILE = "DigiCertGlobalRootG2.crt.pem"              # the root certificate named in the Azure MySQL documentation

credential = DefaultAzureCredential()


def connect():
    """Open a verified TLS connection. The Entra access token is the password, sent with the clear-text plugin over TLS."""
    token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default").token
    return mysql.connector.connect(
        host=HOST, port=3306, database=DB_NAME, user=DB_USER, password=token,
        auth_plugin="mysql_clear_password", ssl_ca=CA_FILE, ssl_verify_cert=True,
        connection_timeout=5)


def place_order(conn, customer_id, total_cents):
    """Add an order inside a transaction and hand back the generated id."""
    cursor = conn.cursor()
    try:
        cursor.execute(
            "INSERT INTO orders (customer_id, total_cents) VALUES (%s, %s)",
            (customer_id, total_cents))
        conn.commit()
        return cursor.lastrowid
    except mysql.connector.Error:
        conn.rollback()
        raise
    finally:
        cursor.close()


def with_retry(action, tries=3):
    """A failover or a maintenance restart drops connections. Reconnect and try again, backing off each time."""
    wait = 2
    while True:
        tries -= 1
        conn = None
        try:
            conn = connect()
            return action(conn)
        except (mysql.connector.InterfaceError, mysql.connector.OperationalError):
            if tries == 0:
                raise
            time.sleep(wait)
            wait *= 2
        finally:
            if conn is not None and conn.is_connected():
                conn.close()


if __name__ == "__main__":
    print("New order id:", with_retry(lambda c: place_order(c, 42, 129900)))

// Program.cs: Entra sign-in, then one order inserted inside a transaction
// NuGet packages: MySqlConnector, Azure.Identity
using Azure.Core;
using Azure.Identity;
using MySqlConnector;

// Entra access tokens expire after roughly an hour, so request one for every new connection
AccessToken token = await new DefaultAzureCredential().GetTokenAsync(
    new TokenRequestContext(new[] { "https://ossrdbms-aad.database.windows.net/.default" }));

var builder = new MySqlConnectionStringBuilder
{
    Server = "orders-mysql-001.mysql.database.azure.com",
    Port = 3306,
    Database = "orders",
    UserID = "orders-app",
    Password = token.Token,
    SslMode = MySqlSslMode.VerifyFull,
    SslCa = "DigiCertGlobalRootG2.crt.pem",   // the root certificate named in the Azure MySQL documentation
    ConnectionTimeout = 5
};

await using var connection = new MySqlConnection(builder.ConnectionString);
await connection.OpenAsync();
await using var txn = await connection.BeginTransactionAsync();

await using var insert = new MySqlCommand(
    "INSERT INTO orders (customer_id, total_cents) VALUES (@customerId, @totalCents)", connection, txn);
insert.Parameters.AddWithValue("@customerId", 42L);
insert.Parameters.AddWithValue("@totalCents", 129900);
await insert.ExecuteNonQueryAsync();

var orderId = insert.LastInsertedId;
await txn.CommitAsync();
Console.WriteLine($"New order id: {orderId}");

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

The same family has other members: Azure SQL Database for SQL Server applications and Azure Database for PostgreSQL for PostgreSQL ones. Web tiers that use MySQL commonly run on Azure Virtual Machines or Azure Functions.