Windmill for Microsoft environments
This page lists what Windmill supports for teams running on Azure, Windows, SQL Server, Microsoft Entra ID and Microsoft Teams, and links to the page that documents each capability.
The edition column repeats what the linked page states, and each edition entry links to the page or section that states it. Capabilities marked Enterprise need Enterprise Edition. An empty edition cell means the linked page states no edition requirement.
Deploy on Azure
| Capability | What it does | Edition |
|---|---|---|
| Windmill on Azure | Deploy Windmill on AKS with an Azure Database for PostgreSQL Flexible Server. The guide covers networking, database, Helm deployment and ingress through an Azure Load Balancer or the Application Gateway Ingress Controller. | |
| Entra ID database authentication | Passwordless authentication of Windmill to PostgreSQL Flexible Server through Azure Workload Identity, with short-lived tokens instead of a static password. | Enterprise |
| Self-host | General self-hosting reference: Docker Compose, Helm chart, and database role setup for managed PostgreSQL services such as Azure Database for PostgreSQL. |
Sign in and provision users
| Capability | What it does | Edition |
|---|---|---|
| Microsoft single sign-on | Sign in to Windmill with Microsoft accounts through an OAuth client registered in Microsoft Entra ID. Emails can be restricted by domain. | Without Enterprise Edition, the number of SSO users is limited to 10 |
| SAML with Microsoft Entra | Authenticate users through an Entra enterprise application over SAML. | Enterprise |
| SCIM with Microsoft Entra | Provision users and groups from Entra. Synced groups appear in Windmill as instance groups. | Enterprise |
| Login-time group sync | Read the groups claim of each SAML or OIDC login and reconcile instance group membership before the session starts. | Enterprise |
Run on Windows
| Capability | What it does | Edition |
|---|---|---|
| Windows workers | Run scripts and flows directly on Windows machines without Docker or WSL, with Python, Bun, PowerShell, C#, Nu, Java, Ruby and R executors. The worker can run as a Windows service. | Self-Hosted Enterprise |
| Agent workers | Workers that connect to the Windmill server over HTTP instead of directly to the database. They can run without Docker on Windows. | Cloud and Self-hosted Enterprise |
| PowerShell scripts | Write PowerShell scripts whose arguments are inferred from the param block. Imported modules are installed automatically when the script runs. | |
| Private PowerShell repository | Install PowerShell modules from an Azure Artifacts feed, configured in the registries instance settings. | Enterprise |
| C# scripts | Write C# scripts with NuGet dependencies declared at the top of the file. | |
| NuGet config | Provide a nuget.config file to set custom or private package sources and credentials. | Enterprise |
Talk to SQL Server
| Capability | What it does | Edition |
|---|---|---|
| MS SQL scripts | Query SQL Server from native SQL scripts with an ms_sql_server resource. MS SQL can also be reached from TypeScript, Python and the other languages on all editions. | The dedicated MS SQL language needs Enterprise or a cloud workspace |
| Windows integrated authentication | Authenticate to SQL Server as the worker instead of with a stored password: Kerberos on Linux workers, Windows SSPI on Windows workers. | Same as MS SQL scripts, on self-hosted or agent workers only, not Cloud's managed workers. Windows workers are Self-Hosted Enterprise |
| Azure workload identity for Azure SQL | On AKS, workers authenticate to Azure SQL as their own managed identity, with no credential stored in the resource. | Same as MS SQL scripts |
| Azure AD (Entra) token | Authenticate to SQL Server with an OAuth token obtained through the Azure OAuth instance setting. | Same as MS SQL scripts |
Secrets and storage
| Capability | What it does | Edition |
|---|---|---|
| Azure Key Vault secret backend | Store Windmill secrets in Azure Key Vault instead of the Windmill database, with a client secret or Azure Workload Identity Federation. | Enterprise |
| Workspace object storage on Azure Blob | Connect a workspace to Azure Blob storage so that scripts read and write files without handling the credentials. See also the Azure Blob resource. | On Community Edition, workspace storage is limited to 10GiB per workspace |
| Instance object storage on Azure Blob | Use Azure Blob at the instance level for large-scale log management and distributed dependency caching. On AKS it can authenticate with Workload Identity instead of an access key. | Enterprise |
| Audit logs export | Continuously export audit logs to the instance object storage bucket, including Azure Blob. | Enterprise |
| DuckDB on Azure Blob | DuckDB scripts read and write Parquet, CSV or JSON on the Azure Blob workspace storage. |
AI providers
| Capability | What it does | Edition |
|---|---|---|
| Azure OpenAI and Azure AI Foundry for Windmill AI | Use Azure OpenAI or Azure AI Foundry models for Windmill AI, with an azure_openai or azure_foundry resource authenticated by API key. | |
| AI agents | Azure OpenAI and Azure AI Foundry are among the providers available to AI agent steps in flows. |
Triggers
| Capability | What it does | Edition |
|---|---|---|
| Azure Event Grid triggers | Trigger scripts and flows when events are delivered from Event Grid custom topics, system topics, domains or Namespace topics. | Self-hosted Enterprise, disabled on Cloud |
Microsoft Teams
| Capability | What it does | Edition |
|---|---|---|
| Teams commands | Run a script or flow from Teams with the /windmill command, through the Windmill Teams bot. On self-hosted instances the bot is set up with a Microsoft Entra app. | The Teams bot needs Enterprise Edition |
| Teams approval steps | Suspend a flow until it is approved or rejected, directly from a Teams message or through a link to the Windmill approval page. | The Teams bot needs Enterprise Edition |
| Write to Teams | Send messages to a Teams channel from scripts with an ms_teams_webhook resource. | |
| Teams error handler | Send error notifications to Teams channels. | Cloud and Enterprise Edition |
| Critical alerts to Teams | Receive instance critical alerts in a Teams channel. | Enterprise |
Git with Azure DevOps
| Capability | What it does | Edition |
|---|---|---|
| Git sync with Azure DevOps | Sync a workspace to an Azure DevOps repository, authenticating with a Microsoft Entra service principal stored in an azure resource. | Cloud and Enterprise Self-Hosted, Community Edition for workspaces with up to 2 users |
Windmill on Azure
Deploy Windmill on Azure AKS with optional Entra ID database auth.
Windows workers
Run Windmill scripts and flows directly on Windows machines without Docker or WSL.
MS SQL integration
Connect SQL Server to Windmill and choose an authentication method.
Microsoft Teams integration
Run scripts from Teams commands and send messages, approvals and alerts to Teams.