Data API builder supports reading the database connection string from an environment variable by using the syntax:

@env( ' MSSQL_CONNECTION_STRING ' )

Microsoft’s DAB documentation explicitly shows that @env( ' MSSQL_CONNECTION_STRING ' ) tells Data API builder to read the connection string from an environment variable at runtime.

That fits this scenario because Azure Container Apps secrets are typically exposed to the container as environment variables . Microsoft’s Azure Container Apps documentation states that environment variables can reference secrets, and DAB’s Azure Container Apps deployment guidance shows a secret being mapped into an environment variable that DAB then reads.

Why the other options are wrong:

A and D incorrectly point the connection string to DAB_CONFIG_BASE64, which is the config payload secret, not the SQL connection string.

C uses secretref: syntax inside dab init, but DAB expects the connection string parameter in the config to use the environment-variable reference syntax @env(...). The secretref: pattern is for Azure Container Apps environment variable configuration, not for the DAB CLI connection-string argument itself.

So the correct command is:

dab init --database-type mssql --connection-string " @env( ' MSSQL_CONNECTION_STRING ' ) " --host-mode Production --config dab-config.json