Question 728 of 997

Implement Azure security →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct approach is to create a contained database user in Azure SQL Database mapped to the system-assigned managed identity, grant the necessary database roles, and then authenticate from the app using a Microsoft Entra ID access token. This works because managed identities provide an automatically managed service principal in Microsoft Entra ID, allowing the app to obtain a token without ever storing credentials in connection strings. The token is acquired from the managed identity endpoint and passed to SQL Database, which validates it against the contained user you created. On the AZ-204 exam, this scenario tests your understanding of how to bridge Azure resources with PaaS databases using identity-based authentication, a common pattern for secure, credential-free access. A frequent trap is forgetting that the SQL database user must be a contained user specifically mapped to the managed identity’s object ID, not a regular SQL login. Memory tip: think “Map, Grant, Token” — map the identity to a contained user, grant roles, then acquire and use the token.

AZ-204 Implement Azure security Practice Question

This AZ-204 practice question tests your understanding of implement azure security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: managed identities are Microsoft Entra ID principals.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

You have an Azure App Service web app that uses a system-assigned managed identity. The web app needs to authenticate to an Azure SQL Database to read and write data. You want to use the managed identity to avoid storing credentials in connection strings. Which steps are required to configure this access?

Question 1mediummultiple choice

Full question →

A
Assign the managed identity the 'SQL DB Contributor' RBAC role on the database, then use SQL authentication with the identity's client ID.
Why wrong: RBAC roles for Azure SQL Database are for management plane operations only (e.g., creating databases). Data plane access requires creating a contained database user. Also, SQL authentication does not use managed identities.
B
Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.
This is the correct procedure. The managed identity (an Microsoft Entra ID principal) must be added as a database user. The app then acquires an access token for Azure SQL Database using the managed identity and uses it to connect.
C
Enable Microsoft Entra ID authentication on the SQL server, add the managed identity as an Microsoft Entra ID admin, and use integrated security in the connection string.
Why wrong: Adding the managed identity as an Microsoft Entra ID admin grants server-level permissions, which is over-privileged. Also, integrated security (Windows authentication) is not applicable to managed identities.
D
Configure the connection string with the managed identity's principal ID as the user ID and leave the password empty.
Why wrong: Connection strings for Microsoft Entra ID authentication require parameters like 'Authentication=Active Directory Managed Identity' and do not use a user ID/password in the traditional sense.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.

Option B is correct because to use a system-assigned managed identity with Azure SQL Database, you must create a contained database user mapped to the managed identity in the SQL database, grant it the necessary database roles (e.g., db_datareader, db_datawriter), and then acquire an access token for Microsoft Entra ID (formerly Azure AD) from the managed identity endpoint to authenticate. This token-based approach avoids storing credentials and leverages the managed identity's automatic credential rotation.

Key principle: Managed identities are Microsoft Entra ID principals.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign the managed identity the 'SQL DB Contributor' RBAC role on the database, then use SQL authentication with the identity's client ID.
Why it's wrong here
RBAC roles for Azure SQL Database are for management plane operations only (e.g., creating databases). Data plane access requires creating a contained database user. Also, SQL authentication does not use managed identities.
✓
Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app.
Why this is correct
This is the correct procedure. The managed identity (an Microsoft Entra ID principal) must be added as a database user. The app then acquires an access token for Azure SQL Database using the managed identity and uses it to connect.
Related concept
Managed identities are Microsoft Entra ID principals.
✗
Enable Microsoft Entra ID authentication on the SQL server, add the managed identity as an Microsoft Entra ID admin, and use integrated security in the connection string.
Why it's wrong here
Adding the managed identity as an Microsoft Entra ID admin grants server-level permissions, which is over-privileged. Also, integrated security (Windows authentication) is not applicable to managed identities.
✗
Configure the connection string with the managed identity's principal ID as the user ID and leave the password empty.
Why it's wrong here
Connection strings for Microsoft Entra ID authentication require parameters like 'Authentication=Active Directory Managed Identity' and do not use a user ID/password in the traditional sense.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates confuse Azure RBAC roles (which manage control-plane access) with SQL database-level permissions (which manage data-plane access), leading them to incorrectly select Option A or C instead of understanding that a contained database user and token-based authentication are required.

Detailed technical explanation

How to think about this question

Under the hood, the system-assigned managed identity obtains an access token for the SQL database resource (https://database.windows.net) via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. The app then uses SqlConnection.AccessToken property to set the token, which SQL Server validates against Microsoft Entra ID. The contained database user is created using the CREATE USER [<identity-name>] FROM EXTERNAL PROVIDER statement, which maps the identity's object ID to a database principal without requiring a login at the server level.

KKey Concepts to Remember

Managed identities are Microsoft Entra ID principals.
Azure SQL Database supports Microsoft Entra ID authentication.
Data plane access to Azure SQL requires a contained database user.
App Services acquire Microsoft Entra ID tokens using their managed identity.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Managed identities are Microsoft Entra ID principals.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Review managed identities are Microsoft Entra ID principals., then practise related AZ-204 questions on the same topic to reinforce the concept.

Related AZ-204 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Develop Azure compute solutions practice questions

Practise AZ-204 questions linked to Develop Azure compute solutions.

Develop for Azure storage practice questions

Practise AZ-204 questions linked to Develop for Azure storage.

Implement Azure security practice questions

Practise AZ-204 questions linked to Implement Azure security.

Connect to and consume Azure services and third-party services practice questions

Practise AZ-204 questions linked to Connect to and consume Azure services and third-party services.

Monitor, troubleshoot, and optimize Azure solutions practice questions

Practise AZ-204 questions linked to Monitor, troubleshoot, and optimize Azure solutions.

AZ-204 fundamentals practice questions

Practise AZ-204 questions linked to AZ-204 fundamentals.

AZ-204 scenario practice questions

Practise AZ-204 questions linked to AZ-204 scenario.

AZ-204 troubleshooting practice questions

Practise AZ-204 questions linked to AZ-204 troubleshooting.

Practice this exam

Start a free AZ-204 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-204 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-204 question test?

Implement Azure security — This question tests Implement Azure security — Managed identities are Microsoft Entra ID principals..

What is the correct answer to this question?

The correct answer is: Create a contained database user in the SQL database mapped to the managed identity, grant required database roles, and use Microsoft Entra ID token-based authentication from the app. — Option B is correct because to use a system-assigned managed identity with Azure SQL Database, you must create a contained database user mapped to the managed identity in the SQL database, grant it the necessary database roles (e.g., db_datareader, db_datawriter), and then acquire an access token for Microsoft Entra ID (formerly Azure AD) from the managed identity endpoint to authenticate. This token-based approach avoids storing credentials and leverages the managed identity's automatic credential rotation.

What should I do if I get this AZ-204 question wrong?

Review managed identities are Microsoft Entra ID principals., then practise related AZ-204 questions on the same topic to reinforce the concept.

What is the key concept behind this question?

Managed identities are Microsoft Entra ID principals.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on AZ-204

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which TWO of the following are valid ways to authenticate an Azure function to an Azure SQL database using managed identity?

medium

A.Create a service principal and assign it to the function app.
B.Use the function app's default connection string with a username and password.
✓ C.Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.
D.Upload a client certificate to the function app and use it to authenticate.
✓ E.Enable system-assigned managed identity on the function app and set the SQL connection string with 'Authentication=Active Directory Managed Identity'.

Why C: System-assigned managed identity and user-assigned managed identity are both supported. Option A and D are correct. Option B is wrong because service principal is not managed identity. Option C is wrong because connection string with username/password is not managed identity. Option E is wrong because certificate authentication is not managed identity.

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.