Use the module’s Test Connection result to separate a credential issue from subscription access or provider registration. This check does not require an order or a real database server.

Run and identify the check

Open PD Modules → AZ PostgreSQL and choose Test Connection after saving the Azure connection. Record the check time and redacted result. The module-level action selects the first available saved account for PD Azure PostgreSQL; it does not test every account or automatically follow the currently viewed offering.

A successful check reads the Microsoft.DBforPostgreSQL registration state and then tries to read resource groups in the subscription. This confirms those reads worked. It is not a write-permission, region-capacity, quota or completed-provisioning test.

Resolve the reported stage

1. For a missing-credential or format message, review the saved JSON and the four required tenant, client, secret and subscription values. The credential may be saved on a different account from the one the check selected.
2. For AADSTS7000215 or an invalid-secret message, confirm the secret Value was used rather than its ID. Have the Azure administrator review whether it expired or was replaced.
3. For AADSTS700016 or an application-not-found message, review the tenant and application IDs together. They must identify the intended app and directory.
4. For AuthorizationFailed, have the Azure administrator inspect the named permission and scope on the intended subscription. A successful subscription read still does not prove Contributor write access.
5. For a Microsoft.DBforPostgreSQL registration message, ask the Azure administrator to review that namespace under the subscription’s Resource providers, complete the required registration and wait for it to finish before repeating the check.
6. For a reachability message, review the host’s ability to reach Microsoft authentication and Azure management over HTTPS. Do not disable certificate validation or other security controls broadly to clear an error.

Interpret expiry and success correctly

If the saved credential contains secret_expires, the test can include a countdown notice. A missing notice does not establish that the actual secret has no expiry: the date is supplied with the credential, and a notice is not automatic rotation or proof of reminder delivery.

After an issue is resolved, repeat the relevant check and confirm the intended offering’s account and resource defaults. Do not create another database merely to diagnose the saved credential. If a provisioning attempt already has an uncertain outcome, reconcile the existing service and Azure result before another attempt.

Do not include secrets, full credential JSON or private account identifiers.

See the PD Azure PostgreSQL Blesta guide for related setup, or explore PD Azure PostgreSQL.