feat(prefect-azure): managed-identity auth for Azure Database for PostgreSQL

[christopherahern]

Adds a set_database_connection_params plugin to prefect-azure so the Prefect server can authenticate to Azure Database for PostgreSQL using a Microsoft Entra ID (managed identity) token instead of a static password. This mirrors the merged prefect-aws RDS IAM plugin (#19580).

closes #22419

What's included

• prefect_azure/plugins.py — the hook returns an async DefaultAzureCredential token as the asyncpg password callable, plus an SSL context; gated by settings.
• prefect_azure/settings.py — AzureSettings().postgres.managed_identity with enabled and optional client_id (PREFECT_INTEGRATIONS_AZURE_POSTGRES_MANAGED_IDENTITY_*).
• prefect.plugins entry point (azure = "prefect_azure.plugins").
• Unit tests, a README section, and docs (integration page + self-hosted Database setup).

How token expiration is handled

The password supplied to asyncpg is a callable, so it is invoked on every new connection. azure-identity caches the token and refreshes it near expiry, and Azure Postgres validates the token only at login — so existing pooled connections are unaffected and new connections always receive a valid token. No manual refresh loop is required.

Verification

Verified end to end against Azure Container Apps and an Entra-only Azure Database for PostgreSQL flexible server (password_auth_enabled = false): the server connected, ran migrations, and served the API with no password anywhere in the system. Tokens were also confirmed to authenticate through Azure's built-in PgBouncer (General Purpose tier, port 6432).

Checklist

• This pull request references any related issue by including "closes prefect-azure: support Microsoft Entra (managed identity) auth for Azure Database for PostgreSQL #22419"
• If this pull request adds new functionality, it includes unit tests that cover the changes
• If this pull request removes docs files, it includes redirect settings in mint.json. (N/A — no docs removed)
• If this pull request adds functions or classes, it includes helpful docstrings.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7750e2185c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Document enabling the plugin system

Following this README snippet on a fresh server process sets only the Azure integration flag, but Prefect only invokes prefect.plugins database hooks when the plugin system itself is enabled. In that scenario the entry point is never loaded, so the password-less URL still reaches asyncpg without the token callback and authentication fails; add PREFECT_PLUGINS_ENABLED=true (or the supported legacy experiments alias) to this example.

Useful? React with 👍 / 👎.

[christopherahern]

Good catch — fixed in d84bc90. The example now enables the plugin system first, using the GA flag PREFECT_PLUGINS_ENABLED=true (prefect-azure targets prefect>=3.7) and referencing the pre-3.7 PREFECT_EXPERIMENTS_PLUGINS_ENABLED alias in a comment. Standardized the same way across the README, the integration docs, and the self-hosted guide (1560efe).