Azure SQL Database Connection Manager in On-Premises SSIS Package

We want to transfer data from an Azure SQL Database to an on-premises SQL Server 2017 via SSIS.

Running the SSIS package in Visual Studio works fine. We tried ADO.NET as well as OLEDB connection manager. Both with SQL Server Authentication.

Then we deployed the SSIS Package to a SQL Server 2017 instance with "standard" connection string created by Visual Studio. We saved the user + password in an environment sensitive variable and run the package directly from the SSIS catalog which failed:

Data Source=XYZ.database.windows.net;User ID=XYZ;Initial Catalog=XYZ;Persist Security Info=True;Application Name=SSIS-XYZ;

An OLE DB record is available. Source: "Microsoft SQL Server Native Client 11.0" Hresult: 0x80004005 Description: "Login timeout expired". An OLE DB record is available. Source: "Microsoft SQL Server Native Client 11.0" Hresult: 0x80004005 Description: "A network-related or instance-specific error has occurred while establishing a connection to SQL Server. Server is not found or not accessible. Check if instance name is correct and if SQL Server is configured to allow remote connections. For more information see SQL Server Books Online.". An OLE DB record is available. Source: "Microsoft SQL Server Native Client 11.0" Hresult: 0x80004005 Description: "Named Pipes Provider: Could not open a connection to SQL Server [53]. ".

Changing the connection string with different parameters or using OLEDB gave us different errors:

Data Source=tcp:XYZ.database.windows.net,1433;User ID=XYZ;Initial Catalog=XYZ;Provider=SQLOLEDB.1;Persist Security Info=True;

Data Source=XYZ.database.windows.net;Initial Catalog=XYZ;Persist Security Info=True;TrustServerCertificate=True

Server=tcp:XYZ.database.windows.net,1433;Initial Catalog=XYZ;User ID=XYZ;Persist Security Info=False;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=True;Connection Timeout=30;

Error: ADO NET Source has failed to acquire the connection {FC7591AE-E345-4603-8144-33E613FE0F98} with the following error message: "A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The target principal name is incorrect.)".

or

An OLE DB record is available. Source: "Microsoft SQL Server Native Client 11.0" Hresult: 0x80040E4D Description: "Invalid authorization specification".

or

Error: ADO NET Source has failed to acquire the connection {FC7591AE-E345-4603-8144-33E613FE0F98} with the following error message: "Login failed for user "XYZ".".

We tried nearly every combination of the parameter in the connection string (false, true)...

We also tried using the user "[username]@[servername]". Same errors.

Connection from the SSIS server to the Azure DB works fine via SSMS.

We found only a few documentation about using Azure as connection manager in SSIS, but never with the information what to do when you deploy the package to a SSIS catalog...

Are we missing something?