Secure, monitor, and optimize data storage and data processing →mediumMultiple ChoiceObjective-mapped
Azure Synapse Serverless SQL Pool Access Control: Entra ID and Azure RBAC
Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only authorized users can access the data via the serverless SQL endpoint, while minimizing administrative overhead. What should you use?
Quick Answer
The minimizing administrative overhead requirement is really the deciding factor among several technically workable-sounding options, and it is what makes Microsoft Entra ID with RBAC the right choice. Because users already have Entra ID identities for everything else in the organization, letting them authenticate to the serverless SQL endpoint with those same identities means there is no separate credential system to create, distribute, or rotate; access is then controlled by assigning Azure RBAC roles on the storage account, which ties permissions directly to each user's existing identity and supports normal identity-based auditing. Compare that to the alternatives: managed identities are meant for one Azure service to authenticate to another automatically, not for a human user to log in, so they do not fit a scenario about individual people accessing data. Storage account access keys grant broad, all-or-nothing access to anyone who holds the key, with no way to distinguish one user's actions from another's, which undermines both least-privilege access and auditability. SAS tokens can be scoped more narrowly, but generating, distributing, and managing a token per user is itself the administrative overhead the requirement is trying to avoid. The pattern to take away: whenever a question emphasizes minimizing administrative overhead for user access alongside a need for per-user authorization, favor the option that reuses an existing identity system over one that requires managing separate credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account.
Microsoft Entra ID authentication allows users to authenticate with their existing identities, and Azure RBAC on the storage account provides granular, identity-based access control without managing separate SQL logins or credentials, minimizing administrative overhead. Option B is incorrect because managed identities are designed for service-to-service authentication, not for individual users. Option C is incorrect because storage account access keys provide broad, shared access that does not support per-user identity and auditing. Option D is incorrect because SAS tokens require token generation and management per user, adding overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Microsoft Entra ID authentication and grant users permissions via Azure RBAC on the storage account.
Why this is correct
Microsoft Entra ID pass-through authentication allows users to authenticate with their Azure AD identities, and RBAC controls access to storage, minimizing overhead.
- ✗
Use managed identities for the serverless SQL pool.
Why it's wrong here
Managed identities are for Azure resources, not for individual user authentication.
- ✗
Use storage account access keys for authentication.
Why it's wrong here
Storage account keys grant full access to the storage account and are not identity-based, leading to security risks and high overhead.
- ✗
Use shared access signatures (SAS) tokens generated for each user.
Why it's wrong here
SAS tokens require token generation and rotation, increasing administrative overhead and not leveraging existing identities.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Introduction to Azure Data Engineering
Key term
Azure RBAC for Data
Azure RBAC for Data is a security system that controls who can read, write, or manage data in Azure storage services using role-based permissions.
Key term
Azure Synapse Analytics
Azure Synapse Analytics is a cloud-based data integration, warehousing, and analytics service that brings together big data and data warehouse capabilities under one platform.
About these practice questions
Courseiva writes every DP-203 question from scratch — 760 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure Synapse Analytics serverless SQL pools to query data in Azure Data Lake Storage Gen2. You need to ensure that only users with specific Microsoft Entra ID roles can query the data. What should you configure?
medium- ✓ A.Assign the Storage Blob Data Contributor role to the users on the Azure Data Lake Storage Gen2 account.
- B.Generate a shared access signature (SAS) token for the storage account and include it in the external table definition.
- C.Configure an IP firewall rule on the storage account to allow only the SQL pool's outbound IP addresses.
- D.Create a managed identity for the SQL pool and grant it access to the storage account.
Why A: Azure Synapse Analytics serverless SQL pools rely on Microsoft Entra ID tokens and RBAC roles to authorize access to data in Azure Data Lake Storage Gen2. The Storage Blob Data Contributor role grants read and write access to data. Option B is wrong because SAS tokens are shared secrets, not tied to user identity. Option C is wrong because firewall rules control network access, not user-level authorization. Option D is wrong because managed identity is not suitable for per-user authorization.
Variation 2. Your organization uses Azure Synapse Analytics with serverless SQL pools. You need to ensure that only users with specific Microsoft Entra ID roles can query external tables referencing Azure Data Lake Storage Gen2. What should you configure?
medium- A.Assign a managed identity to the serverless SQL pool and grant it Storage Blob Data Reader on the storage account.
- B.Use Azure RBAC to assign Storage Blob Data Reader role to the users on the storage account.
- C.Configure a storage account firewall to allow only the Synapse workspace IP range.
- ✓ D.Grant SELECT permission on the external table to specific Microsoft Entra ID users or groups.
Why D: Granting SELECT permission on the external table directly controls which Microsoft Entra ID users or groups can query the data via the serverless SQL pool. This approach uses Azure AD authentication to restrict access at the query level, not at the storage layer. Option A is incorrect because assigning a managed identity to the serverless pool provides a service identity, but it does not restrict access per user. Option B is incorrect because Azure RBAC on the storage account grants data access at the storage level, not through the Synapse SQL engine, and does not limit querying via external tables. Option C is incorrect because the storage account firewall controls network access, not user identity, and does not prevent authorized users from other networks from querying.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.