@ScottH Can you please try this in options.

options={
        "host": "<sql-server-host>.database.windows.net",
        "port": "1433",
        "authentication": "ActiveDirectoryServicePrincipal",
        "client_id": "<service-principal-client-id>",
        "client_secret": "<service-principal-client-secret>",
        "tenant_id": "<azure-ad-tenant-id>",
        "applicationIntent": "ReadOnly",
        "trustServerCertificate": "true"
    }