Stable Release v7.0.3

This update brings the following changes since the 7.0.2 release:

The core driver and its companion packages ship together as version 7.0.3. Update the companion packages you use alongside the driver to 7.0.3. Assembly versions remain 7.0.0.0, unchanged from 7.0.2.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.3
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 — includes the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections.
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.3
• Microsoft.Data.SqlClient.Internal.Logging 7.0.3

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#4370, #4306, #4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#4528, #4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#4445, #4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#4532, #4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#4520, #4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#4520, #4561, #4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#2214, #4547, #4663)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Full details: release-notes/7.0/7.0.3.md

Stable Release v6.1.7

This update brings the following changes since the 6.1.6 release:

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#4598)

Fixed

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#4445, #4584)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#4532, #4552)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#4520, #4560)

• Fixed token authentication state handling so clearing SqlConnection.AccessToken preserves an existing AccessTokenCallback in the connection pool key, and clearing AccessTokenCallback preserves an existing AccessToken. Callback-based authentication now also follows the same prelogin server-certificate validation rules as an explicitly supplied access token.
  (#4520, #4560)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#2214, #4547, #4664)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Full details: release-notes/6.1/6.1.7.md

Preview Release v7.1.0-preview3

This update brings the following changes since the 7.1.0-preview2 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview3. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview3

Added

• Asynchronous key store provider APIs for Always Encrypted — four virtual methods on SqlColumnEncryptionKeyStoreProvider with CancellationToken support. Purely additive; defaults delegate to the synchronous methods, so existing providers are unaffected (#3672, #3673)
• Connection Pool V2 nears parity with the default pool (opt-in via Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2):
  • Transaction support (#4487)
  • Broken-connection replacement during command execution (#4429)
  • Background warmup to Min Pool Size and automatic replenishment (#4452)
  • Idle pruning driven by Connection Idle Timeout (#4463)
  • Optional ConcurrencyLimiter rate limiting for new physical connections (#4395, #4396)
  • Leaked connection reclamation, including the previously always-zero number-of-reclaimed-connections counter (#4529)
  • Metrics and tracing parity with the default pool (#4504)

Changed

• Single cross-platform build — Windows-only native SNI types now trim cleanly on Linux and macOS. Package structure and contents unchanged (#4207, #4239, #4465, #4474)
• Async read-path allocations restored to baseline via PacketData node reuse — ExecuteReaderAsync goes from +120.9% to +0.1% against 6.1.6 (#4536)
• SqlBulkCopy skips graph alias mapping when no graph pseudo-columns are present, recovering a regression from #3677 (#4535)
• No formatted trace string is allocated when SqlClientEventSource tracing is disabled, recovering a memory regression against 6.1.6. Trace output unchanged (#4528)
• net9.0 dependencies moved to 9.0.18; System.Threading.RateLimiting added to packaged metadata. Other targets keep their 8.0.x pins (#4507)
• Microsoft.Data.SqlClient.SNI and .SNI.runtime updated to 7.1.0-preview3.26226.3 (#4564)

Fixed

• Always Encrypted VSM/HGS attestation now verifies the enclave public key is bound to the signed report, using a fixed-time SHA-256 comparison against EnclaveData (#4532)
• SqlConnectionFactory no longer wakes the process every 30 seconds when no pools exist — including with Pooling=False and after ClearAllPools() (#1881, #4479)
• Connection pool performance counters affecting the default pool as well as pool V2 — active-soft-connects and number-of-active-connections could go negative after a failed activation, and several gauges drifted upward permanently after a broken connection was replaced (#4504)
• OverflowException when sending large decimal values with explicit Precision and Scale, which primarily affected Always Encrypted (#1655, #4443)
• TDS stream error when passing a DateOnly value with SqlDbType.Variant (net8.0/net9.0) (#3953, #4294)
• DateOnly in table-valued parameter sql_variant columns sent as datetime instead of date, which overflowed for values valid as date (net8.0/net9.0) (#3934, #4439)
• ServerCertificate keyword ignored when the platform reported no TLS policy errors. It is now always compared, and an unloadable certificate fails closed with SSLCertificateAuthenticationException instead of silently falling back to host-name validation (#4445)
• SqlConnection.AccessTokenCallback not disabling TNIR by default, plus pool-key construction and SspiContextProvider exclusivity with token auth (net462 for the TNIR behavior) (#4520)
• Fatal exceptions such as OutOfMemoryException captured into faulted Tasks across several SqlBulkCopy, SqlDataReader, and SqlCommand async entry points (#4437)
• Entra ID authentication failing against multi-segment authorities such as the Dataverse / Dynamics 365 TDS endpoint. Ships in Microsoft.Data.SqlClient.Extensions.Azure (#4496, #4521)

Full details: release-notes/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3

Added

• SqlColumnEncryptionAzureKeyVaultProvider overrides the four asynchronous key store provider methods introduced in #3673, calling the Azure SDK's own async APIs and flowing the supplied CancellationToken (#4540)
• Concurrent cache misses for the same key collapse into a single Key Vault request. The gate is only awaited, so no thread blocks, and misses for different keys still proceed in parallel (#4540)

Fixed

• The 2000-entry column master key signature cache could stop compacting and grow unbounded — LocalCache.GetOrCreate compacted only on Count == maxSize, an equality test that concurrency could step past. It now compacts on Count >= maxSize (#4540)
• Concurrent callers no longer create duplicate CryptographyClient instances for the same key (#4540)

Behavior change: VerifyColumnMasterKeyMetadata and VerifyColumnMasterKeyMetadataAsync now reject a null or empty signature with ArgumentNullException / ArgumentException instead of passing it through to the Azure SDK. In-product callers are unaffected.

Runtime requirement: this version requires Microsoft.Data.SqlClient 7.1.0-preview3 or later at runtime, because the overridden methods only exist on the 7.1 base class. The NuGet dependency floor covers restore, but downgrading the driver below 7.1 at runtime produces a TypeLoadException.

Full details: release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview3

Fixed

• Entra ID tenant parsing for multi-segment authorities — the tenant is now taken from the first path segment rather than the last, so an OAuth v1 style authority such as .../{tenantId}/oauth2/authorize no longer yields the literal tenant id "authorize". Unparseable authorities raise a clear AuthenticationException, and provider errors are no longer re-wrapped as "Unexpected error". Bare authorities from Azure SQL, Fabric, and Synapse are unaffected (#4496, #4521)

Full details: release-notes/Extensions/Azure/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3

• No functional or API changes; aligned version bump only.

Full details: release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3

• Internal-use-only package. No functional or API changes; aligned version bump only.

Full details: [release-notes/Internal/Logging/7.1/7.1.0-preview3.md](https://github.com/dotnet/SqlClient/blob/main/release-notes/I...

Preview Release v7.1.0-preview2

This update brings the following changes since the 7.1.0-preview1 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview2. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview2 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview2 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview2

Added

• SqlConnection.GetSchemaAsync overloads with CancellationToken support (#3005)
• SQL Graph pseudo-column aliases ($node_id, $edge_id, $from_id, $to_id) accepted in SqlBulkCopy mappings (#3677)
• SqlBatchCommand.CommandBehavior and SqlBatch.ExecuteReader(CommandBehavior) are now honored (#4125)
• Configurable idle connection timeout via Connection Idle Timeout / SqlConnectionStringBuilder.IdleTimeout (opt-in via Switch.Microsoft.Data.SqlClient.UseLegacyIdleTimeoutBehavior=false) (#4295)

Changed

• Connect Timeout now propagates through the pool when Switch.Microsoft.Data.SqlClient.UseOverallConnectTimeoutForPoolWait=true is set (default off; introduces a Microsoft.Bcl.TimeProvider dependency) (#4270)
• SQL Server 2025 json type added to the DataTypes collection returned by SqlConnection.GetSchema (#3858)
• Internal state-machine hardening via Interlocked.CompareExchange guards (#4267)
• Internal cleanup of connection-options inheritance and related pool interfaces (#4237, #4261, #4235, #4415, #4334)
• LCID hardcoded mappings to avoid repeated culture lookups (#4212)
• Allocation reductions on SqlErrorCollection and null-return paths (#4157, #4099, #4102)
• Improved EnclaveDiffieHellmanInfo.Size accuracy (#4346)
• SqlVector<float> serialization is now explicitly little-endian for cross-architecture consistency (#3861)
• Bundled .NET 10 SDK updated to 10.0.300 (#4287)

Fixed

• NullReferenceException in SqlCommand.Cancel() when the connection has already been torn down (#4372)
• Always Encrypted CMK signature verification incorrectly reusing cached results after a prior failure (#4339)
• Missing TDS token / feature-ack length bounds checks (spoofing server could trigger unbounded allocations) (#4340)
• SqlBulkCopy failing in least-privilege environments (#4306)
• Always Encrypted CekMdVersion / EkValueCount reads aligned with the TDS specification (#4240)
• LoginWithFailover parser-state validation (#4140)
• SPN during login now uses the resolved port instead of instance name for Protocol=None / Protocol=Admin (#4180)
• Race in SqlConnection.TryOpenInner that could surface as InvalidCastException now returns a deterministic InvalidOperationException (#4179)
• Multiple CancellationTokenSource leaks in SqlDataReader, SqlConnection, SqlCommand reconnect paths, and sequential-stream helpers (#4009)
• Docs fix for server certificate configuration (#4408)

Removed (breaking)

• SQL Server 7.0 / 2000 code paths removed; Type System Version=SQL Server 2000 now throws ArgumentException at open. Applications should switch to Latest (or another supported value). No change to server-version support — 7.0 / 2000 were already rejected during login version negotiation. (#4015)

Full details: release-notes/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview2

Added — WAM (Windows Account Manager) broker support for Entra ID authentication (Windows only) (#4288, #4388)

• Covers ActiveDirectoryIntegrated, ActiveDirectoryInteractive, ActiveDirectoryDeviceCodeFlow, and the deprecated ActiveDirectoryPassword modes.
• New ActiveDirectoryAuthenticationProviderOptions type (UseWamBroker, ApplicationClientId, DeviceCodeFlowCallback) and a new ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions) constructor overload.
• New cross-platform SetParentActivityOrWindowFunc(Func<object>?) (supersedes the .NET-Framework-only SetIWin32WindowFunc).
• New useWamBroker attribute on the <SqlClientAuthenticationProviders> configuration section.
• Device Code Flow now uses its own token-lifetime timeout instead of inheriting Connect Timeout, fixing spurious "The operation was canceled." failures when users take longer to enter the code.
• WAM is enabled by default when the driver's built-in client id is used; opt-in via UseWamBroker / the config attribute when a custom client id is supplied. Non-Windows platforms never invoke the broker.
• Footprint note: WAM materially increases the on-disk footprint of Microsoft.Data.SqlClient.Extensions.Azure because it pulls in Microsoft.Identity.Client.Broker and its native OS-broker components. Tracking: #4410.
• Sample: new AzureSqlConnector app under doc/apps/AzureSqlConnector.

Changed

• Dependencies: added Microsoft.Identity.Client.Broker 4.84.2; updated Microsoft.Identity.Client to 4.84.2.

Full details: release-notes/Extensions/Azure/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview2

• No functional or API changes; aligned version bump only.

Full details: release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview2

• No functional or API changes; aligned version bump only.

Full details: release-notes/Extensions/Abstractions/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview2

• Internal-use-only package. No functional or API changes; aligned version bump only.

Full details: release-notes/Internal/Logging/7.1/7.1.0-preview2.md

---

Target Platforms

• .NET Framework 4.6.2+ (Windows x86, x64, ARM64)
• .NET 8.0+ (Windows x86, x64, ARM, ARM64; Linux; macOS)

Per-TFM dependency lists are in the linked release-notes files above.

Contributors

A huge thank you to our community contributors for this release:

• @edwardneal — SqlConnection.GetSchemaAsync (#3005), SQL Graph column aliases (#3677), least-privilege SqlBulkCopy (#4306), Always Encrypted TDS alignment (#4240), LCID mapping (#4212), SqlVector little-endian (#3861), DataTypes + json type (#3858), test reliability (#4262, #4305)
• @SimonCropp — SQL Server 7.0 / 2000 removal (#4015), CancellationTokenSource cleanup (#4009), error/warning fast path (#4157), additional code-health (#4099, #4102, #4158)
• @campersau — SqlBatchCommand.CommandBehavior (#4125)
• @jnyrup — EnclaveDiffieHellmanInfo.Size (#4346)
• @shreyarao4 — Kerberos SSPI + SequentialAccess test fixes (#4146, #4224)

Stable Release - v7.0.2

This update brings the following changes since the 7.0.1 release:

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0 (the Microsoft.Data.SqlClient and Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider assembly versions are unchanged). On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected.

Companion package release notes

The following companion packages ship aligned as 7.0.2. See their individual release notes for package-specific changes (including the Microsoft.Data.SqlClient.Extensions.Azure WAM broker support):

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.2
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.2
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2

Fixed

• Fixed a NullReferenceException in SqlCommand.Cancel(). The diagnostic message built during cancellation dereferenced the active connection directly; it now uses a null-conditional access so cancellation no longer throws when the connection has already been torn down.
  (#4372,#4373)

• Fixed a NullReferenceException in SqlDataReader when calling GetBytes/GetChars with a null destination buffer. The argument-validation path that constructs the InvalidDestinationBufferIndex exception now guards against the null buffer so the correct ArgumentException is surfaced instead of an NRE.
  (#4159,#4206)

• Fixed Always Encrypted column master key signature verification incorrectly reusing cached results. The SignatureVerificationCache lookup logic was corrected so signature verification outcomes are cached and retrieved against the correct key, preventing stale or mismatched verification results.
  (#4339,#4343)

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token and feature-extension-acknowledgment data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#4340,#4358)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:

• Connections that previously parsed malformed token streams loosely will now fail fast with a clear protocol error. Well-behaved SQL Server responses are unaffected.

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• SimonCropp

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

Stable Release v6.1.6

This update brings the following changes since the 6.1.5 release:

Added

WAM broker support for the supported Entra ID authentication modes (Windows only)

What Changed:

• Added support for the Web Account Manager (WAM) broker for the supported Microsoft Entra ID authentication modes. A new ActiveDirectoryAuthenticationProviderOptions options bag and a corresponding ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor were introduced, exposing a UseWamBroker property (alongside ApplicationClientId and DeviceCodeFlowCallback).
  (#4288, #4387)
• Added a cross-platform SetParentActivityOrWindowFunc(Func<object> parentActivityOrWindowFunc) method so callers can supply a parent window handle on Windows or a parent Activity/UIViewController on Android/iOS/MAUI.

Who Benefits:

• Applications using ActiveDirectoryInteractive and other supported Entra ID authentication modes on Windows benefit from the WAM broker's improved security (tokens are brokered by the OS), single sign-on with the logged-in Windows account, and support for Conditional Access and Windows Hello.

Impact:

• When you supply your ApplicationClientId, WAM is opt-in via ActiveDirectoryAuthenticationProviderOptions.UseWamBroker. Consider enabling it when you want OS-brokered tokens, single sign-on with the signed-in Windows account, Windows Hello, and Conditional Access support.
• UseWamBroker is a Windows-only setting and has no effect on non-Windows platforms, where interactive Entra ID flows always use the system browser.
• Prefer the new options-bag constructor over the positional-argument overloads in new code.

var options = new ActiveDirectoryAuthenticationProviderOptions
{
    ApplicationClientId = "<your-app-client-id>",
    // Enable WAM (Windows only) for OS-brokered tokens, SSO, Windows Hello, and Conditional Access.
    UseWamBroker = true,
};
var provider = new ActiveDirectoryAuthenticationProvider(options);
// Supply the parent window/activity that owns the interactive sign-in prompt.
provider.SetParentActivityOrWindowFunc(() => parentWindowHandle);
SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, provider);

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#4340, #4359)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:

• Connections that previously parsed malformed token streams loosely will now fail fast with a clear protocol error. Well-behaved SQL Server responses are unaffected.

Other changes

• Updated dependencies (#4387):
  • Updated Microsoft.Identity.Client to 4.84.2 (was 4.80.0)
  • Added Microsoft.Identity.Client.Broker 4.84.2

Fixed

• Fixed a NullReferenceException in SqlDataReader.GetChars on the PLP + CommandBehavior.SequentialAccess path when a null buffer was passed together with a negative bufferIndex. The call now correctly throws ArgumentOutOfRangeException for the bufferIndex parameter.
  (#4159, #4205)

• Fixed column master key (CMK) signature verification caching where GetSignatureVerificationResult returned whether the cache key existed rather than the cached value itself. Once a signature verification failure was cached as false, subsequent lookups incorrectly returned true, causing the caller to skip re-verification and treat the column master key as having a valid signature.
  (#4339, #4356)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.11
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.11
• System.Diagnostics.DiagnosticSource 9.0.11
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 9.0.11

.NET Standard 2.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6

Preview Release v7.1.0-preview1

This update brings the following changes since the 7.0.0 release:

Added

SqlBatch Support on .NET Framework

What Changed:

• Added SqlBatch and related batch-command support for the .NET Framework target so the batching API is now available across the full supported platform matrix, including net462. (#3926)

Who Benefits:

• Applications that target .NET Framework but also want to use the newer batching APIs no longer need a separate implementation strategy from .NET 8/9 applications.
• Libraries that multi-target .NET Framework and modern .NET can use a more consistent data-access surface area.

Impact:

• SqlBatch, SqlBatchCommand, and the related execution methods are now usable on .NET Framework builds in addition to .NET.

Cross-Driver Connection-String Synonym Alignment

What Changed:

• Added additional accepted connection-string synonyms for better compatibility with other SQL Server drivers and existing connection-string conventions. Newly accepted synonyms include ColumnEncryption, ConnectTimeout, FailoverPartner, PacketSize, and WorkstationId. (#4192)

Who Benefits:

• Applications migrating connection strings from other SQL Server drivers or shared infrastructure can reuse more existing keywords without rewriting them first.

Impact:

• Existing canonical keywords continue to work unchanged; this preview simply accepts more equivalent aliases during parsing.

Changed

Type Forwards for Authentication Abstractions

What Changed:

• Added type forwards from the core Microsoft.Data.SqlClient assembly to public authentication-related types that were moved into Microsoft.Data.SqlClient.Extensions.Abstractions, including SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. (#4067, #4117)

Who Benefits:

• Applications and libraries compiled against earlier package layouts retain binary compatibility when those authentication types are resolved from the core assembly name.

Impact:

• No application code changes are required; the type forwards preserve existing compiled references.

User Agent Feature Extension Enabled by Default

What Changed:

• Enabled the User Agent TDS feature extension by default and removed the opt-in requirement to toggle it through Switch.Microsoft.Data.SqlClient.EnableUserAgent. (#4124, #4154)

Who Benefits:

• Operators and diagnostic tooling gain more consistent client-identification metadata during connection establishment without extra application configuration.

Impact:

• User-agent metadata is now always sent during login. Applications that previously enabled the switch explicitly can remove that configuration with no functional loss.

Other changes

• Reduced allocations when sending large string values to SQL Server. (#4072)
• Internal source-build and packaging consolidation updates: (#4033, #4068, #4204)

Fixed

• Fixed SqlBulkCopy failing on SQL Server 2016 with Invalid column name 'graph_type' by extracting graph-column metadata with dynamic SQL instead of referencing the column directly. (#3714, #4092, #4147)
• Fixed SqlBulkCopy support for Azure Synapse Analytics dedicated SQL pools by using a Synapse-compatible column-list query path. (#4149, #4176, #4182)
• Fixed SqlDataReader.GetFieldType() and GetProviderSpecificFieldType() to return SqlVector<float> metadata for vector float32 columns instead of byte[]. (#4104, #4105, #4152)
• Added the missing System.Data.Common NuGet dependency for .NET Framework consumers to avoid CS0012 compile failures against newer ADO.NET surface area. (#4063, #4074)
• Fixed a SqlDataReader streaming bug where calling IsDBNull() before reading a streamed value could skip column data. (#4082)
• Fixed a NullReferenceException in SqlDataReader during specific reader state transitions. (#4159)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

Stable Release v6.1.5

This update brings the following changes since the 6.1.4 release:

Fixed

• Fixed a connection performance regression where SPN (Service Principal Name) generation was triggered for non-integrated authentication modes (e.g., SQL authentication) on the native SNI path, causing unnecessary DNS lookups and significantly slower connection times. Only affects .NET on Windows (not .NET Framework). (#3523, #3946)
• Fixed ExecuteScalar to properly propagate errors when the server sends data followed by an error token. Previously, errors such as conversion failures during WHERE clause evaluation were silently consumed during SqlDataReader.Close() instead of being thrown to the caller, which could result in transactions being unexpectedly zombied. (#3736, #3947)
• Fixed SqlDataReader.GetFieldType and SqlDataReader.GetProviderSpecificFieldType to return the correct type (SqlVector<float>) for vector float32 columns. Previously, these methods did not follow the same type-resolution logic as GetValue, returning an incorrect type for vector columns. (#4104, #4151)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.11
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.11
• System.Diagnostics.DiagnosticSource 9.0.11
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 9.0.11

.NET Standard 2.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6

Stable Release - v7.0.1

This update brings the following changes since the 7.0.0 release:

Fixed

• Fixed SqlBulkCopy failing on SQL Server 2016 with Invalid column name 'graph_type' error. The column metadata query now uses dynamic SQL so that references to the graph_type column (introduced in SQL Server 2017) are not compiled on older versions that lack the column. (#3714, #4092, #4147)

• Fixed SqlBulkCopy failing on Azure Synapse Analytics dedicated SQL pools. The column-list query previously used a variable-assignment pattern that Synapse does not support; it now uses STRING_AGG when targeting Synapse (engine edition 6) and falls back to the variable-assignment approach for SQL Server 2016 compatibility. (#4149, #4176, #4182)

• Fixed SqlDataReader.GetFieldType() and GetProviderSpecificFieldType() returning typeof(byte[]) instead of typeof(SqlVector<float>) for vector float32 columns. The methods now follow the same type-determination logic as GetValue(). (#4104, #4105, #4152)

• Added missing System.Data.Common (v4.3.0) NuGet package dependency for .NET Framework consumers. The inbox System.Data.Common assembly on .NET Framework predates APIs such as IDbColumnSchemaGenerator; without the explicit NuGet dependency, consumers encountered CS0012 compilation errors when using these types through Microsoft.Data.SqlClient. (#4063, #4074)

Changed

• Enabled the User Agent TDS feature extension unconditionally. The Switch.Microsoft.Data.SqlClient.EnableUserAgent AppContext switch has been removed; the driver now always sends User Agent information during login. (#4124, #4154)

• Added type forwards from the core Microsoft.Data.SqlClient assembly to public types that were moved to the Microsoft.Data.SqlClient.Extensions.Abstractions package: SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. This ensures binary compatibility for assemblies compiled against earlier versions of Microsoft.Data.SqlClient where these types lived in the core assembly. (#4067, #4117)

• Fixed API documentation include paths and duplicate doc snippets. (#4084, #4086, #4107, #4161)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

Stable Release v7.0.0

This is the general availability release of Microsoft.Data.SqlClient 7.0, a major milestone for the .NET data provider for SQL Server. This release addresses the most upvoted issue in the repository's history — extracting Azure dependencies from the core package — introduces pluggable SSPI authentication, adds enhanced routing for Azure SQL Hyperscale, and delivers async read performance improvements.

Also released as part of this milestone:

• Released Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.Extensions.Azure 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.Internal.Logging 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.0. See release notes.

Changes Since 7.0.0-preview4

Added

• Added actionable error message when Entra ID authentication methods are used without the Microsoft.Data.SqlClient.Extensions.Azure package installed, guiding users to install the correct package. (#3962, #4046)
• Added Azure authentication sample application. (#3988)

Changed

Other changes

• Renamed the Microsoft.Data.SqlClient.Extensions.Logging package to Microsoft.Data.SqlClient.Internal.Logging to indicate it is for internal use only and should not be referenced directly by application code. (#4038)
• Fixed non-localized exception strings. (#4022)
• Codebase merge and cleanup: (#3997, #4052)
• Various test improvements: (#3891, #3996, #4002, #4034, #4041, #4044)
• Documentation improvements (including Entra ID branding updates): (#4021, #4047, #4049)
• Updated Dependencies (#4045):
  • Updated Azure.Core to v1.51.1
  • Updated Azure.Identity to v1.18.0
  • Updated Azure.Security.KeyVault.Keys to v4.9.0
  • Updated Microsoft.Extensions.Caching.Memory to v9.0.13 (.NET 9.0)
  • Updated Microsoft.IdentityModel.JsonWebTokens to v8.16.0
  • Updated Microsoft.IdentityModel.Protocols.OpenIdConnect to v8.16.0
  • Updated Microsoft.Bcl.Cryptography to v9.0.13 (.NET 9.0)
  • Updated System.Configuration.ConfigurationManager to v9.0.13 (.NET 9.0)
  • Updated System.Diagnostics.DiagnosticSource to v10.0.3
  • Updated System.Security.Cryptography.Pkcs to v9.0.13 (.NET 9.0)
  • Updated System.Text.Json to v10.0.3
  • Updated System.Threading.Channels to v10.0.3
  • Updated System.ValueTuple to v4.6.2

Cumulative Changes Since 6.1

This section summarizes all changes across the 7.0 preview cycle for users upgrading from the latest 6.1 stable release.

Changed

Azure Dependencies Removed from Core Package

What Changed:

• The core Microsoft.Data.SqlClient package no longer depends on Azure.Core, Azure.Identity, or their transitive dependencies (e.g., Microsoft.Identity.Client, Microsoft.Web.WebView2). Azure Active Directory / Entra ID authentication functionality (ActiveDirectoryAuthenticationProvider and related types) has been extracted into a new Microsoft.Data.SqlClient.Extensions.Azure package. (#1108, #3680, #3902, #3904, #3908, #3917, #3982, #3978, #3986)
• Two additional packages were introduced to support this separation: Microsoft.Data.SqlClient.Extensions.Abstractions (shared types between the core driver and extensions) and Microsoft.Data.SqlClient.Internal.Logging (shared ETW tracing infrastructure). (#3626, #3628, #3967, #4038)

Who Benefits:

• All users benefit from a significantly lighter core package. Previously, the Azure dependency chain pulled in numerous assemblies even for applications that only needed basic SQL Server connectivity. This was the most upvoted open issue in the repository.
• Users who do not use Entra ID authentication no longer carry Azure-related assemblies in their build output.
• Users who do use Entra ID authentication can now manage Azure dependency versions independently from the core driver.

Impact:

• Applications using Entra ID authentication (e.g., ActiveDirectoryInteractive, ActiveDirectoryDefault, ActiveDirectoryManagedIdentity, etc.) must now install the Microsoft.Data.SqlClient.Extensions.Azure NuGet package separately:

dotnet add package Microsoft.Data.SqlClient.Extensions.Azure

• No code changes are required beyond adding the package reference.
• If an Entra ID authentication method is used without the Azure package installed, the driver now provides an actionable error message guiding users to install the correct package.

Added

Pluggable Authentication with SspiContextProvider

What Changed:

• Added a public SspiContextProvider property on SqlConnection, completing the SSPI extensibility work begun in 6.1.0. Applications can now supply a custom SSPI context provider for integrated authentication, enabling custom Kerberos ticket negotiation and NTLM username/password authentication scenarios. (#2253, #2494)

Who Benefits:

• Users authenticating across untrusted domains, non-domain-joined machines, or cross-platform environments where configuring integrated authentication is difficult.
• Users running in containers who need manual Kerberos negotiation without deploying sidecars or external ticket-refresh mechanisms.
• Users who need NTLM username/password authentication to SQL Server, which the driver does not provide natively.

Impact:

• Applications can set a custom SspiContextProvider on SqlConnection before opening the connection:

var connection = new SqlConnection(connectionString);
connection.SspiContextProvider = new MyKerberosProvider();
connection.Open();

• The provider handles the authentication token exchange during integrated authentication. Existing authentication behavior is unchanged when no custom provider is set. See SspiContextProvider_CustomProvider.cs for a sample implementation.
• Note: The SspiContextProvider is part of the connection pool key. Care should be taken when using this property to ensure the implementation returns a stable identity per resource.

Async Read Performance: Packet Multiplexing (Preview)

What Changed:

• Continued refinement of packet multiplexing with bug fixes and stability improvements since 6.1.0, plus new app context switches for opt-in control. (#3534, #3537, #3605)

Who Benefits:

• Applications performing large async reads (ExecuteReaderAsync with big result sets, streaming scenarios, or bulk data retrieval).

Impact:

• Packet multiplexing ships behind two opt-in feature switches:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.UseCompatibilityAsyncBehaviour", false);
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.UseCompatibilityProcessSni", false);

• Setting both switches to false enables the new async processing path. By default, the driver uses the existing (compatible) behavior.

Enhanced Routing Support

What Changed:

• Added support for enhanced routing, a TDS feature that allows the server to redirect connections to a specific server and database during login. (#3641, #3969, #3970, #3973)

Who Benefits:

• Users connecting to Azure SQL Hyperscale environments that use named read replicas and gateway-based load balancing.

Impact:

• Enhanced routing is negotiated automatically during login when the server supports it. No application code changes are required.

Support for .NET 10

What Changed:

• Updated pipelines and test suites to compile the driver using the .NET 10 SDK. (#3686)

Who Benefits:

• Developers targeting .NET 10 on day one.

Impact:

• SqlClient 7.0 compiles and tests against ...