Connect Azure Database for MySQL to Excel, Sheets and AI

TLS here follows the checkbox, not the hostname

This is the one place where copying the Azure PostgreSQL page across would be wrong, so it is worth stating plainly.

• Use SSL is on by default, and while it is on the connection is encrypted — the agent asks MySQL for a required TLS session.
• Turn it off and the agent will attempt an unencrypted connection. Nothing in the MySQL path overrides that based on the hostname, which is exactly where this card differs from Azure PostgreSQL.
• The reason is structural rather than an oversight: the agent keeps a table of hosted Postgres hostnames it forces TLS for, and there is no MySQL equivalent. The checkbox is the whole mechanism.
• Encryption is not certificate verification. The agent requires TLS but does not validate the server's certificate chain, so treat it as protection against eavesdropping on the wire rather than proof of what you reached.

Flexible server, and the username trap

Azure has offered MySQL under two shapes, and they disagree about what a username looks like. The card takes a side.

• This card is built for flexible server. The port defaults to 3306 and the server name ends in .mysql.database.azure.com.
• Flexible server uses plain usernames. The retired single server offering used the user@servername form, and if you paste one the card tells you to drop the suffix rather than letting Azure reject it later as an authentication failure.
• That is a better place to catch it. An @servername login fails at the far end as a generic auth error, which sends people to reset passwords that were never wrong.
• A password with leading or trailing whitespace is flagged too. It is a clipboard artifact and it also fails as an ordinary authentication error.

Private endpoints suit the agent well

Because the agent dials out and never listens, the usual reason to expose a database server does not apply.

• Put the agent on a VM inside the same VNet and point it at the private endpoint. Public access can stay switched off.
• There is no inbound firewall rule to add, no IP allowlist to maintain and no VPN between your network and ours. The agent opens the connection outward.
• Authentication is a username and a password. Microsoft Entra ID is not wired into this connector, so use a MySQL login scoped to read what you intend to expose.
• A read-only user is worth the two minutes. Query Streams will not write, but the safest way to guarantee that is at the database.

-- Ordinary MySQL, read-only, over TLS
SELECT   c.name,
         COUNT(o.id)   AS orders,
         SUM(o.amount) AS revenue
FROM     customers AS c
JOIN     orders    AS o ON o.customer_id = c.id
WHERE    o.placed_at >= NOW() - INTERVAL 30 DAY
GROUP BY c.name
ORDER BY revenue DESC;