Quickstart: Connect Azure Spring Apps to databases and services with Service Connector

2025-08-19

Get started with Service Connector to connect your Azure Spring Apps to databases, storage accounts, and other Azure services. Service Connector simplifies authentication and configuration, enabling you to connect to resources using managed identities other authentication methods.

This article provides step-by-step instructions for both the Azure portal and Azure CLI. Choose your preferred method using the tabs above.

Note

The Basic, Standard, and Enterprise plans entered a retirement period on March 17, 2025. For more information, see the Azure Spring Apps retirement announcement.

The Standard consumption and dedicated plan entered a retirement period on September 30, 2024, with a complete shutdown by the end of March 2025. For more information, see Migrate Azure Spring Apps Standard consumption and dedicated plan to Azure Container Apps.

Prerequisites

An Azure account with an active subscription. Create an Azure account for free.
An app deployed to Azure Spring Apps in a region supported by Service Connector.
A target resource to connect Azure Spring Apps to. For example, a Azure Key Vault.
The necessary permissions to create and manage service connections.

An Azure account with an active subscription. Create an Azure account for free.
An app deployed to Azure Spring Apps in a region supported by Service Connector.
A target resource to connect Azure Spring Apps to. For example, a Azure Key Vault.
The necessary permissions to create and manage service connections.

Use the Bash environment in Azure Cloud Shell. For more information, see Get started with Azure Cloud Shell.
If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
- If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Authenticate to Azure using Azure CLI.
- When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use and manage extensions with the Azure CLI.
- Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

Version 2.37.0 or higher of the Azure CLI. To upgrade to the latest version, run az upgrade. If using Azure Cloud Shell, the latest version is already installed.
The Azure Spring Apps extension must be installed in the Azure CLI or the Cloud Shell. To install it, run az extension add --name spring.

Initial setup

If you're using Service Connector for the first time, start by running the command az provider register to register the Service Connector resource provider.
```
az provider register -n Microsoft.ServiceLinker
```
Tip

You can check if the resource provider has already been registered by running the command az provider show -n "Microsoft.ServiceLinker" --query registrationState. If the output is Registered, then Service Connector has already been registered.
Optionally, run the following command to get a list of supported target services for Azure Spring Apps.
```
az spring connection list-support-types --output table
```
Tip

If the az spring command isn't recognized by the system, check that you have installed the required extension by running az extension add --name spring.

Create a service connection

Use Service Connector to create a secure service connection between your Azure Spring Apps and Azure Blob Storage. This example demonstrates connecting to Blob Storage, but you can use the same process for other supported Azure services.

Select the Search resources, services and docs (G +/) search bar at the top of the Azure portal, type Azure Spring Apps in the filter and select Azure Spring Apps.
Select the name of the Azure Spring Apps instance you want to connect to a target resource.
Under Settings, select Apps and select the application from the list.
Select Service Connector from the service menu and select Create.

On the Basics tab, select or enter the following settings. Screenshot of the Azure portal, fill basic info to create a connection.

Setting	Example	Description
Service type	Key Vault	The type of service you're going to connect your app to.
Connection name	keyvault_17d38	The connection name that identifies the connection between your app and target service. Use the connection name provided by Service Connector or enter your own connection name.
Subscription	my-subscription	The subscription that contains your target service (the service you want to connect to). The default value is the subscription that contains the app deployed to Azure Spring Apps.
Key vault	my-keyvault-name	The target Key Vault you want to connect to. If you choose a different service type, select the corresponding target service instance.
Client type	SpringBoot	The application stack that works with the selected target service. Besides SpringBoot and Java, other stacks are also supported.

Select Next: Authentication to select the authentication type. We recommend you use a system-assigned managed identity to connect to your Key Vault.
Select Next: Networking to select the network configuration and select Configure firewall rules to enable access to target service so that your app can reach the Blob Storage.
Select Next: Review + Create to review the provided information. Wait a few seconds for Service Connector to validate the information and select Create to create the service connection.

Managed identity (recommended)
Connection string

Run the az spring connection create command to connect an application deployed to Azure Spring Apps to a Blob Storage resource, with a system-assigned managed identity. You can run this command in two different ways:

Generate the new connection step by step.

   az spring connection create storage-blob --system-identity

Generate the new connection at once. Replace the placeholders with your own information: <source-subscription>, <source_resource_group>, <azure-spring-apps-resource>, <app>, <target-subscription>, <target_resource_group>, and <account>.

   az containerapp connection create storage-blob \                         
   --source-id /subscriptions/<source-subscription>/resourceGroups/<source_resource_group>/providers/Microsoft.AppPlatform/Spring/<azure-spring-apps-resource>/apps/<app> \
   --target-id /subscriptions/<target-subscription>/resourceGroups/<target_resource_group>/providers/Microsoft.Storage/storageAccounts/<account>/blobServices/default \
   --system-identity

Tip

If you don't have a Blob Storage account, run az spring connection create storage-blob --new --system-identity to create one and connect it to your application hosted on Azure Spring Apps using a managed identity.

Warning

Microsoft recommends that you use the most secure authentication flow available. The authentication flow described in this procedure requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows, such as managed identities, aren't viable.

Run the az spring connection create command to connect an application deployed to Azure Spring Apps to a Blob Storage resource, with connection string. You can run this command in two different ways:

Generate the new connection step by step.

az spring connection create storage-blob --secret

az containerapp connection create storage-blob \                         
   --source-id /subscriptions/<source-subscription>/resourceGroups/<source_resource_group>/providers/Microsoft.AppPlatform/Spring/<azure-spring-apps-resource>/apps/<app> \
   --target-id /subscriptions/<target-subscription>/resourceGroups/<target_resource_group>/providers/Microsoft.Storage/storageAccounts/<account>/blobServices/default \
    --secret name=<secret-name> secret=<secret>

Tip

If you don't have a Blob Storage account, run az spring connection create storage-blob --new --secret to create one and connect it to your application hosted on Azure Spring Apps using a connection string.

View service connections

Azure Spring Apps connections are displayed under Settings > Service Connector.

Select > to expand the list and access the properties required by your application.
Select Validate to check your connection status, and select Learn more to review the connection validation details.

Run az spring connection list command to list all of your Azure Spring Apps' provisioned connections.

Replace the placeholders <azure-spring-apps-resource-group>, <azure-spring-apps-resource-name>, and <app-name> from the command below with your own information. You can also remove the --output table option to view more information about your connections.

az spring connection list --resource-group <azure-spring-apps-resource-group> --service <azure-spring-resource-name> --app <app-name> --output table

The output also displays the provisioning state of your connections.

Check the guides below for more information about Service Connector and Azure Spring Apps:

Share via

Quickstart: Connect Azure Spring Apps to databases and services with Service Connector

Prerequisites

Initial setup

Create a service connection

View service connections

Related content

Feedback

Additional resources