OptionalallowExplicitly accept an UNENCRYPTED connection to a non-local host. Default false → the driver refuses plaintext to a remote host (local hosts are always allowed).
OptionalauthAuthentication mode. 'sql' (default) uses username/password. 'entra-service-principal'
authenticates with a Microsoft Entra service principal (tenantId/clientId/clientSecret from the
credential) — required for Microsoft Fabric SQL endpoints, which speak TDS but refuse SQL auth.
When unset, the driver infers 'entra-service-principal' if the credential carries a clientId,
otherwise 'sql' (so a correctly-shaped credential Just Works without setting this).
OptionaldatabaseOptionalhostOptionalinstanceNamed instance (e.g. 'SQLEXPRESS'); mutually exclusive with an explicit port on most setups.
OptionalmaxMax pool connections (default 5).
OptionalportOptionalserverServer host (accepts server or host).
OptionalsslEnable TLS encryption for the connection.
OptionalsslWhether TLS must present a trusted certificate. Defaults to TRUE (verify the server cert).
Set to false only for managed/self-signed dev endpoints that you knowingly accept — doing so
disables MITM protection. Maps to mssql trustServerCertificate.
Non-secret connection config stored in ExternalDataSource.ConnectionConfig (JSON).