1433 by default, and let the Authentication dropdown decide the rest of the form: a SQL Server login, a Kerberos ticket from your domain, or a Microsoft Entra ID work account. The protocol underneath is TDS 7.4, which every server from 2012 on speaks, so Windows, Linux, Docker and Azure SQL Database are all reachable.
The driver is not in the app. Picking in the Choose a Database sheet offers the
download before the form opens, and opening a saved connection installs it without asking.
Settings > Plugins > Browse > installs it up front. See Plugins.
Quick setup
Click Create Connection…, select SQL Server, fill in the fields, then click Save & Connect. For Azure SQL Database, useyourserver.database.windows.net and an SSL mode of Required (skip verify) or stricter.
SQL Server connection form
Connection URL
Windows Authentication (Kerberos)
On macOS, Windows Authentication means Kerberos. Set Authentication to Windows Authentication (Kerberos), then either leave Kerberos Principal and Password blank to use the ticket in your credential cache, or enteruser@REALM.COM and your domain password to have one requested at connect. Get a cached ticket with kinit user@REALM.COM; klist shows it.
Four things have to hold:
- Connect by hostname, never an IP address. Kerberos targets the service principal name
MSSQLSvc/host.domain.com:1433, registered against the host name. - Write the realm in uppercase, usually the DNS domain:
CONTOSO.COM. - This Mac has to reach the domain’s KDC, through DNS SRV records or
/etc/krb5.conf. - The SQL Server service account has to own that SPN. Your administrator registers it.
default_realm, map its DNS domain and the ticket is requested there instead:
[domain_realm] entry falls back to default_realm. TablePro never runs kinit or edits /etc/krb5.conf.
Microsoft Entra ID
Set Authentication to Microsoft Entra ID to sign in with a work account instead of a SQL Server login: Azure SQL Database, Azure SQL Managed Instance, and SQL Server 2022 with Entra authentication enabled.1
Register an application
In the Azure portal, under App registrations, add one with platform Mobile and desktop applications, Allow public client flows set to Yes, and the delegated permission Azure SQL Database → user_impersonation.
2
Create the database user
3
Sign in
Fill in the two fields and click Test Connection. A one-time code goes to the clipboard and your browser opens on the sign-in page. Paste it, approve, then test again.
CREATE USER … FROM EXTERNAL PROVIDER against the database you are opening.
Databases and schemas
The sidebar nests tables under their schema, hides the built-in role schemas (db_owner, guest, and the rest), and marks master, tempdb, model and msdb as system databases. Press Cmd+K to change database: the switch happens in place, with no reconnect. Opening a table queries it in the schema it is listed under, so a table outside dbo needs no switch first.
INSERTs from the data grid leave IDENTITY columns out, so the server assigns them, and TEXTSIZE is raised at connect, so nvarchar(max) and text values arrive whole rather than cut to FreeTDS’s 2048-byte default.
SSL/TLS
New connections start on Preferred.
Verification runs against the macOS system roots at
/etc/ssl/cert.pem, which covers Azure SQL and anything else publicly trusted. See SSL/TLS.
SQL Server connections can also run through the Cloud SQL Auth Proxy, which TablePro starts and stops for you.
Limitations
- Named instances are not supported. Give the host and the TCP port that instance listens on.
- NTLM is not supported: Windows Authentication on macOS is Kerberos only.
- Entra ID connections are created on the Mac only, through the device code flow only. iPhone and iPad take them over sync and prompt to sign in when you open one.
- The SSL pane offers no certificate fields here. Verification runs against the system trust store; a private trust anchor goes in your own
freetds.conf.
Troubleshooting
Failed to connect to host:1433: …
The tail is FreeTDS’s own message. Nothing listening means TCP/IP is off in SQL Server Configuration Manager, the service is down, or port 1433 is closed. A rejected login means the credentials, or a server that takes Windows Authentication only:SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') returns 1 for that, and mixed mode goes on in SSMS under Server Properties > Security. A login scoped to one database, an Azure SQL contained user for instance, needs Database filled in; without it the server authenticates against master and refuses.
No Kerberos ticket was found.
There is no ticket in the credential cache. Runkinit user@REALM.COM, or fill in Kerberos Principal and Password, then reconnect.
Server not found in Kerberos database
Reported asThe SQL Server Kerberos service principal name is not registered. The server has no SPN, or has one in a realm this Mac does not map the host to. Ask your administrator to register MSSQLSvc/host.domain.com:1433, connect by hostname rather than IP, and add a [domain_realm] entry for a cross-realm server.