AZ-500 Question 174
Single answerYou have configured Microsoft Entra (Azure AD) as the admin for an Azure SQL Database server. You want a group of developers in your organization, who are members of an Azure AD group, to authenticate with the Azure SQL Database using their Entra credentials. The developers report that they are receiving login errors when attempting to connect. Which additional step must you perform to enable database access for these developers?
- A
Assign the Azure AD group the Contributor role for the Azure SQL server resource
- B
Create a contained database user in Azure SQL Database that references the Azure AD group
- C
Enable 'Allow Azure services and resources to access this server' in the server firewall settings
- D
Manually add each individual developer as an external user to the Azure SQL Database
Show answer and explanation
Correct answer: B
Explanation
When you configure Microsoft Entra (Azure AD) authentication for Azure SQL Database, you must set an Azure AD admin at the server level. However, to allow group-based access, you also need to create a contained database user that references the Azure AD group. This is a key step to ensure that valid Azure AD credentials are recognized at the database level. For more details, see Microsoft documentation on 'Azure SQL Database and Azure AD authentication.'
- A. Incorrect.
Option 1: Assigning the Contributor role at the Azure SQL server resource level grants permissions to manage the server resource in Azure, not to authenticate from the database engine. This does not enable direct database access using Azure AD credentials.
- B. Correct.
Option 2: This is correct. Even after setting an Azure AD admin at the server level, you must create a contained user inside the database for the Azure AD group. Once the contained database user is in place, members of that Azure AD group can successfully log in using their Entra credentials.
- C. Incorrect.
Option 3: Enabling 'Allow Azure services and resources to access this server' allows services like Azure App Service or Azure Data Factory to connect, but does not specifically grant Azure AD authentication permissions to users in an Azure AD group.
- D. Incorrect.
Option 4: Manually adding each developer as an external user is not necessary if you want to enable group-based access. Granting access to the entire Azure AD group via a contained database user is the recommended and more efficient practice.