diff --git a/clojure/resources/logback.xml b/clojure/resources/logback.xml
index a0a21ac3..da9d0be8 100644
--- a/clojure/resources/logback.xml
+++ b/clojure/resources/logback.xml
@@ -21,6 +21,13 @@
     </encoder>
   </appender>
 
+  <!-- azure-identity logs every credential it tries in its DefaultAzureCredential
+       chain (EnvironmentCredential unavailable, WorkloadIdentity unavailable,
+       ManagedIdentity unavailable, etc.) at INFO/WARN — expected on a developer
+       machine but very noisy. Suppress to WARN/ERROR respectively. -->
+  <logger name="com.azure.identity" level="WARN"/>
+  <logger name="com.microsoft.aad.msal4j" level="ERROR"/>
+
   <root level="INFO">
     <appender-ref ref="CONSOLE"/>
     <appender-ref ref="FILE"/>
diff --git a/clojure/test/pgloader/load_file/ast_test.clj b/clojure/test/pgloader/load_file/ast_test.clj
index 5a3b9252..7ee61f2c 100644
--- a/clojure/test/pgloader/load_file/ast_test.clj
+++ b/clojure/test/pgloader/load_file/ast_test.clj
@@ -95,12 +95,12 @@
         "com.microsoft.aad.msal4j must be on the classpath for ActiveDirectoryPassword / ActiveDirectoryServicePrincipal auth")))
 
 (deftest test-azure-identity-on-classpath
-  (testing "azure-identity is bundled — ActiveDirectoryDefault / AzCli / WorkloadIdentity auth modes are available"
+  (testing "azure-identity is bundled — ActiveDirectoryDefault auth mode is available"
     (is (try (Class/forName "com.azure.identity.DefaultAzureCredentialBuilder")
              true
              (catch ClassNotFoundException _
                false))
-        "com.azure.identity must be on the classpath for ActiveDirectoryDefault / ActiveDirectoryAzCli / ActiveDirectoryWorkloadIdentity auth")))
+        "com.azure.identity must be on the classpath for ActiveDirectoryDefault auth")))
 
 (deftest test-parse-postgresql-synthesises-jdbc-url
   (testing "postgresql:// synthesises jdbc-url"
diff --git a/docs/ref/mssql.rst b/docs/ref/mssql.rst
index f030231e..8ef9e562 100644
--- a/docs/ref/mssql.rst
+++ b/docs/ref/mssql.rst
@@ -356,21 +356,21 @@ and ``authentication=`` reach the driver exactly as written.
 
 Quick reference:
 
-+--------------------------------------+------------------------------------------------+
-| Mode                                 | Typical use case                               |
-+======================================+================================================+
-| ``ActiveDirectoryServicePrincipal``  | CI/CD — app registration (client ID + secret)  |
-+--------------------------------------+------------------------------------------------+
-| ``ActiveDirectoryManagedIdentity``   | Azure VM / App Service / AKS — no credentials |
-+--------------------------------------+------------------------------------------------+
-| ``ActiveDirectoryDefault``           | Developer laptop: ``az login`` fallback chain  |
-+--------------------------------------+------------------------------------------------+
-| ``ActiveDirectoryAzCli``             | Developer laptop: explicit ``az login`` token  |
-+--------------------------------------+------------------------------------------------+
-| ``ActiveDirectoryWorkloadIdentity``  | Kubernetes OIDC workload identity              |
-+--------------------------------------+------------------------------------------------+
-| ``ActiveDirectoryPassword``          | **Deprecated** — blocked by MFA enforcement    |
-+--------------------------------------+------------------------------------------------+
++--------------------------------------------+------------------------------------------------+
+| Mode                                       | Typical use case                               |
++============================================+================================================+
+| ``ActiveDirectoryServicePrincipal``        | CI/CD — app registration (client ID + secret)  |
++--------------------------------------------+------------------------------------------------+
+| ``ActiveDirectoryServicePrincipalCertif.`` | CI/CD — app registration with certificate      |
++--------------------------------------------+------------------------------------------------+
+| ``ActiveDirectoryManagedIdentity``         | Azure VM / App Service / AKS — no credentials |
++--------------------------------------------+------------------------------------------------+
+| ``ActiveDirectoryDefault``                 | Developer laptop: ``az login`` fallback chain  |
++--------------------------------------------+------------------------------------------------+
+| ``ActiveDirectoryIntegrated``              | Windows / Kerberos domain-joined machine       |
++--------------------------------------------+------------------------------------------------+
+| ``ActiveDirectoryPassword``                | **Deprecated** — blocked by MFA enforcement    |
++--------------------------------------------+------------------------------------------------+
 
 ``ActiveDirectoryServicePrincipal``
     Authenticate as an Azure AD application (client ID + client secret) —
@@ -402,19 +402,12 @@ authentication=ActiveDirectoryDefault;encrypt=true;trustServerCertificate=false"
     get-access-token`` using your existing ``az login`` session — no browser
     popup is needed.
 
-``ActiveDirectoryAzCli``
-    Like ``ActiveDirectoryDefault`` but always uses the Azure CLI token
-    exclusively.  Useful when you want a predictable, unambiguous credential
-    source on a developer machine::
+``ActiveDirectoryIntegrated``
+    Authenticate via Kerberos on a domain-joined machine.  Requires a valid
+    Kerberos ticket (``kinit`` on Linux/macOS, automatic on Windows)::
 
         FROM "jdbc:sqlserver://myserver.database.windows.net:1433;databaseName=mydb;\
-authentication=ActiveDirectoryAzCli;encrypt=true;trustServerCertificate=false"
-
-``ActiveDirectoryWorkloadIdentity``
-    For Kubernetes pods with OIDC workload identity federation::
-
-        FROM "jdbc:sqlserver://myserver.database.windows.net:1433;databaseName=mydb;\
-authentication=ActiveDirectoryWorkloadIdentity;encrypt=true"
+authentication=ActiveDirectoryIntegrated;encrypt=true"
 
 ``ActiveDirectoryPassword``
     .. note::