Azure Database for PostgreSQL + CHIONAzure PostgreSQL natural language to SQL
with each SELECT visible
The Azure build-it-yourself route wires Azure OpenAI to a prompt you write and a guardrail you keep tuning. It wins when the model choice has to stay inside your own subscription. Chion does Azure PostgreSQL natural language to SQL against Flexible Server instead. Ask "department-level cost trends this quarter?" and Chion generates a SELECT, passes it through the application validators, executes it read-only on port 5432 or through the pooler on 6432, and leaves the executed query on screen beneath the chart.
- Flexible Server on port 5432, or the built-in pooler on 6432
- Every executed SELECT left on screen under its chart
Read-only SELECT, capped at 1,000 rows, filtered by the policies on the role you supply.
Chion reads your Azure Database for PostgreSQL Flexible Server through a dedicated read-only role, which is what makes it usable as an AI analyst for your SQL. Follow-up questions stay tied to the SELECT that produced the last answer, so analytics in plain conversation keeps its evidence. The password sits in an AES-256-GCM vault, results cap at 1,000 rows, and the policies attached to the role you supply filter every call. Save a query a person has reviewed and the skills generator for SQL compiles it for Claude Code or Codex, which is the durable form of an AI workforce for SQL.
Connect Flexible Server read-only with a dedicated role
What changes when your PostgreSQL lives on Azure.
Flexible Server, not the retired Single Server
Microsoft retired Single Server in March 2025. Chion connects to Flexible Server; if a server is still on Single Server, migrate it first and point Chion at the new server name.
PgBouncer on port 6432
Azure's built-in pooler answers on port 6432. Use it for high-concurrency teams; connect directly on 5432 otherwise. Chion's read-only query pattern is compatible with transaction pooling.
Firewall rules, not open access
Under Networking, add a firewall rule for the Chion IP range rather than opening the server to the internet. The same least-privilege posture runs through Chion's security model.
TLS 1.2+ with sslmode=require
Chion connects with sslmode=require by default and performs no certificate pinning. Azure Flexible Server enforces TLS 1.2 or higher, so no extra configuration is needed.
Connect today with a dedicated read-only role
Create a dedicated read-only role, hand Chion the password, and the connection is live with no identity-provider setup required. Microsoft Entra ID (Azure AD) authentication is on the enterprise roadmap. See how Chion compiles a code-validated SQL pipeline end to end.
Read-only is enforced in code, not asked of the model.
Every query passes a two-layer SQL validator before it ever reaches Azure, runs as a read-only SELECT capped at 1,000 rows, and honors the row-level security on the role you provide. The model cannot opt out. The guardrail lives in code, not in a prompt.
Skip the Azure OpenAI tutorial
The build-it-yourself route on Azure means wiring up Azure OpenAI, writing the prompt, and maintaining whatever guardrail you put around the generated statement. That route wins when you need your own model choice and your own retrieval logic inside your own subscription. Chion enforces read-only in code instead, so the guardrail is not a prompt you keep tuning.
A saved query compiles into a SKILL.md
When a reviewer saves a query, Chion compiles it into a SKILL.md you run in Claude Code or Codex. The file carries the query text and its context. It does not carry a live connection to Flexible Server, so each runtime still needs its own access path.
Example question & SQL
See what Chion generates from a plain-English question.
You ask
"Top 10 customers by total spend this quarter"
Chion generates
SELECT
c.name,
SUM(o.total) AS total_spend
FROM customers c
JOIN orders o ON o.customer_id = c.id
WHERE o.created_at >= date_trunc('quarter', now())
GROUP BY c.name
ORDER BY total_spend DESC
LIMIT 10;Create a read-only Postgres role
Run this once before you connect. Chion enforces read-only at the SQL validator, but a least-privilege role is the canonical pattern.
CREATE ROLE chion_read LOGIN PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE <dbname> TO chion_read;
GRANT USAGE ON SCHEMA public TO chion_read;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO chion_read;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
GRANT SELECT ON TABLES TO chion_read;Replace <dbname> with your database name. The ALTER DEFAULT PRIVILEGES line ensures new tables are auto-readable.
Connection string format
Reference for parsing. Chion accepts the six fields directly, no string concatenation needed.
postgresql://chion_read:<password>@<server-name>.postgres.database.azure.com:5432/<dbname>?sslmode=requireFinding your Azure Database for PostgreSQL credentials
Azure Portal → your PostgreSQL server → Overview page
| Field | Where to Find | Default |
|---|---|---|
| Server (Host) | Overview page → Server name | <server>.postgres.database.azure.com |
| Port | Overview or Connection strings page | 5432 |
| Database | Created by default. Check via Connection strings or psql | postgres |
| Schema | Not in portal; default is public | public |
| User | Overview page → Admin username | What you set at creation |
| Password | Set at creation. Reset via Settings → Reset password | (not retrievable) |
Quick steps
- 1.Log in at portal.azure.com
- 2.Search for "Azure Database for PostgreSQL servers"
- 3.Click your server name
- 4.On the Overview page: copy the Server name (this is your host) and note the Admin username
- 5.Click Connection strings in the left sidebar for pre-built connection strings
- 6.Password is what you set during creation; reset via Settings → Reset password if needed
Azure Flexible Server uses port 5432 for direct connections and 6432 for the built-in PgBouncer pooler.
Open Azure Database for PostgreSQL consoleAzure Database for PostgreSQL troubleshooting
Common issues and how to fix them.
Port mismatch: 5432 vs 6432
Azure Flexible Server uses port 5432 for direct connections and port 6432 for the built-in PgBouncer pooler. If you copied the pooler connection string, make sure you also use port 6432 in Chion.
Firewall rule blocking connection
In the Azure Portal, go to your PostgreSQL server → Networking → add a firewall rule allowing the Chion IP range. For initial testing, enable "Allow public access from any Azure service".
Password reset
Go to your server → Settings → Reset password. The new password takes effect immediately.
TLS / SSL handshake failure
Azure requires TLS 1.2 or higher. Chion connects with sslmode=require by default; no extra config needed. If you see SSL errors, verify the server has not enforced TLS 1.3-only and that no firewall is intercepting the handshake.
Official Azure Database for PostgreSQL documentation
Authoritative references from the provider. Opens in a new tab.
- Azure Database for PostgreSQL Flexible Server
Official overview, networking modes, and connection guidance, checked 2026-09-01.
- Connect with PgBouncer
Built-in PgBouncer config and the port 6432 pooler endpoint, checked 2026-09-01.
- Single Server retirement notice
March 2025 deprecation timeline and migration paths to Flexible Server, checked 2026-09-01.
- Azure OpenAI Service overview
The managed-model path an Azure team would build the DIY route on, checked 2026-09-01.
- PostgreSQL CREATE ROLE
Reference for the read-only role used by Chion, checked 2026-09-01.
Your credentials are encrypted
The password for your Flexible Server role is sealed in an AES-256-GCM envelope. Plaintext is decrypted into memory for a single request, held for at most 60 seconds or five reads, then purged. Chion holds read-only permissions only, and the code validators reject any generated statement that is not a single read-only SELECT. The grants and row-level security policies on that Azure role decide what a query can return.
Read the full security modelFrequently asked questions
Common questions about using Chion with Azure Database for PostgreSQL.
Does Chion work with Azure Flexible Server?
Can I use the built-in PgBouncer?
Does Chion support Azure Private Link?
Can I use Microsoft Entra ID (Azure AD) authentication?
Single Server is retired. What should I do?
What TLS version does Chion require?
Other PostgreSQL providers
Chion connects to Neon, Supabase, Amazon RDS, Google Cloud SQL, and Azure Database for PostgreSQL.
Ready to connect your Azure Database for PostgreSQL database?
Open Chion, enter your credentials, and start asking questions in plain English.
Start your 7-day trial