The two required actions to enable Microsoft Entra ID authentication for Azure SQL Database are setting a Microsoft Entra ID administrator for the logical server and creating a contained database user mapped to an Entra ID identity. The server-level administrator establishes the Entra ID tenant as a trusted identity provider, which allows the SQL logical server to accept token-based authentication from Entra ID users. The contained database user is then necessary because Azure SQL Database authenticates users directly at the database level, not through a login in the master database, so each user must be defined as a contained user within the target database. On the DP-300 exam, this question tests your understanding of the two-layer authentication model: server-level identity provider configuration and database-level user creation. A common trap is thinking that creating a login in the master database is sufficient, but Azure SQL Database requires contained users for Entra ID. Memory tip: think “server admin + database user” — the server trusts Entra, the database trusts the user.
DP-300 Implement a secure environment Practice Question
This DP-300 practice question tests your understanding of implement a secure environment. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO actions are required to enable Microsoft Entra ID authentication for Azure SQL Database?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set an Microsoft Entra ID administrator for the logical server
Setting a Microsoft Entra ID administrator for the logical server (Option A) is required because it establishes the Entra ID tenant as an identity provider for the Azure SQL Database logical server, enabling token-based authentication. Creating a contained database user mapped to an Entra ID identity (Option D) is required because Azure SQL Database uses contained database users for authentication, where the user is authenticated directly against the database without requiring a login in the master database. These two actions together allow Entra ID users to authenticate to the database using their cloud identities.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Set an Microsoft Entra ID administrator for the logical server
Why this is correct
Required to enable Entra ID authentication at the server level.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a login in the master database for each Entra ID user
Why it's wrong here
Entra ID users are created as contained database users, not logins in master.
✗
Assign a system-assigned managed identity to the logical server
Why it's wrong here
Not required for basic Entra ID authentication.
✓
Create a contained database user mapped to an Entra ID identity
Why this is correct
Required to allow Entra ID users to access the database.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable 'contained database authentication' on the server
Why it's wrong here
Azure SQL Database always uses contained databases; this is not a separate step.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the on-premises SQL Server requirement of enabling 'contained database authentication' with Azure SQL Database, which always has this enabled, and they mistakenly think creating logins in master is necessary for Entra ID users when contained database users are the correct approach.
Detailed technical explanation
How to think about this question
Under the hood, Entra ID authentication for Azure SQL Database relies on OAuth 2.0 tokens issued by the Entra ID tenant. The logical server's Entra ID administrator is granted the 'loginmanager' and 'dbmanager' roles in the master database, allowing them to provision contained database users. When a contained database user is created with 'FROM EXTERNAL PROVIDER', Azure SQL Database stores the user's object ID (a GUID) from Entra ID, and during authentication, the database validates the token's signature and claims against this stored ID. A real-world scenario is a multi-tenant SaaS application where each tenant's users are in different Entra ID tenants; you must create separate contained database users for each tenant's users, but you cannot have multiple Entra ID administrators on the same logical server.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this DP-300 question in full detail.
Implement a secure environment — This question tests Implement a secure environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Set an Microsoft Entra ID administrator for the logical server — Setting a Microsoft Entra ID administrator for the logical server (Option A) is required because it establishes the Entra ID tenant as an identity provider for the Azure SQL Database logical server, enabling token-based authentication. Creating a contained database user mapped to an Entra ID identity (Option D) is required because Azure SQL Database uses contained database users for authentication, where the user is authenticated directly against the database without requiring a login in the master database. These two actions together allow Entra ID users to authenticate to the database using their cloud identities.
What should I do if I get this DP-300 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions are required to enable Microsoft Entra ID authentication for an Azure SQL Database?
medium
A.Enable SQL Server authentication only.
✓ B.Set an Microsoft Entra ID admin for the Azure SQL Server.
✓ C.Create contained database users mapped to Microsoft Entra ID identities.
D.Assign the SQL Server Contributor role to the Entra ID users.
E.Enable Azure AD integration on the SQL server.
Why B: To enable Entra ID authentication, you must set an Entra ID admin for the SQL server and create contained database users mapped to Entra ID identities. Enabling Azure AD (Entra ID) integration is automatic. Assigning Azure RBAC roles is for management plane, not database authentication. The SQL Server authentication mode is always enabled.
Variation 2. Which THREE actions are required to configure Microsoft Entra ID authentication for an Azure SQL Database? (Choose three.)
hard
A.Configure a firewall rule to allow connections from the Microsoft Entra ID service.
✓ B.Set a Microsoft Entra ID administrator for the Azure SQL Database server.
✓ C.Create contained database users in the database mapped to Microsoft Entra identities.
✓ D.Ensure that the Microsoft Entra identity used to connect is a member of the same Azure AD tenant as the server.
E.Ensure that SQL authentication is enabled as a fallback.
Why B: Option B is correct because setting a Microsoft Entra ID administrator for the Azure SQL Database server is a mandatory step to enable Entra ID authentication at the server level. This action configures the server to accept authentication tokens from the specified Entra ID tenant and allows the creation of contained database users mapped to Entra identities.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.