App service cannot connect to postgresql

Hi ahd,
Thankyou for reaching microsoft Q&A!
Thanks for the clarification — since authentication is now working, the issue is most likely related to permissions and how migrations are being executed, not connectivity.

In Azure Database for PostgreSQL Flexible Server, creating a new database is typically restricted to the admin user defined at server creation. If your migration process is trying to run CREATE DATABASE, it will fail unless you are using that admin role. The recommended approach is to create the database upfront using the portal, CLI, or admin user, and then use migrations only for schema changes like tables and indexes.

You should also verify that the user you are using has sufficient permissions on the target database. Even if login succeeds, migrations can fail if the user does not have rights on the schema. You can grant access using:

GRANT ALL PRIVILEGES ON DATABASE your_db TO your_user;

Another important point is how migrations are executed. Running migrations from an Azure App Service during startup is not always reliable, especially for one-time or deployment-time operations. A better approach is to execute migrations from your CI/CD pipeline using an agent that has network access to the private database, such as a self-hosted agent inside the VNet. You can also use a separate job or container dedicated to running migrations.

Since your database is private, make sure that whatever process is running the migrations has proper VNet integration and can resolve the database’s private DNS endpoint correctly.

For Next.js or Node.js-based applications like Payload CMS, migrations are usually handled using tools such as Prisma, Knex, or Sequelize. For example, with Prisma you can run npx prisma migrate deploy, and with Knex you can run knex migrate:latest. These commands should be executed from an environment that has both correct permissions and network access.

, ensure the database is pre-created using an admin account, grant proper schema permissions to your application user, and run migrations from a controlled environment like a pipeline or dedicated job rather than relying on App Service startup.