Connecting to an on-premise SQL Server from a Function App.

Hi Jonathan Farmer,

Thank you for posting your question in the Microsoft Q&A forum

Here are the reasons why the “Failed to generate SSPI context” error might occur -

Your connection string includes Trusted_Connection=True.

That means you’re asking SQL Server to use Windows Authentication (Kerberos/NTLM) instead of SQL Authentication.

When you run locally (on your machine + VPN + domain login), it works, because your machine has a valid domain identity that SQL Server can trust.

But when your Azure Function App runs, it does not have a domain identity. Azure can’t impersonate your AD user → so Kerberos handshake fails → SSPI context error.

Updated connection string:

string connectionString = "Server=<servername>\AAAAAA;Database=<database>;User Id=<sql_username>;Password=<sql_password>;TrustServerCertificate=True;";

Update your connection string to remove Trusted_Connection=True and just use the SQL credentials

Yes, it is possible to connect to onprem SQL from the azure function. You can refer to (Hybrid Connections in Azure App Service - Azure App Service | Microsoft Learn) document to create the hybrid connection and how it works.

The hybrid connection is not supported in Consumption Plan and works with Windows OS for azure function with other plans as mentioned in (Azure Functions networking options | Microsoft Learn) article.

You need to create the function app under the app service plan.

Reference URL

https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options#matrix-of-networking-features

Cannot generate SSPI context when connecting to SQL Server - SQL Server | Microsoft Learn

Remove Trusted_Connection=True and use SQL Authentication instead. That will eliminate the SSPI error.