DP-300 Implement a secure environment Practice Question
Your company uses Azure SQL Database with Microsoft Entra ID (formerly Azure AD) authentication. You need to grant a group of external consultants access to a specific database with read-only permissions. The consultants are from a partner organization that uses their own Microsoft Entra ID tenant. What should you do?
⚠ Common exam trap
It's easy for candidates to assume you can directly map a contained database user to an external UPN without first establishing cross-tenant identity via B2B collaboration, or they mistakenly think Azure SQL Database can natively trust another Entra ID tenant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Invite the consultants as guest users in your Microsoft Entra ID tenant using B2B collaboration, then create a contained database user for each guest user
External consultants from a different Microsoft Entra ID tenant must first be invited as guest users via B2B collaboration to your tenant. Once they are guest users, you can create contained database users in Azure SQL Database mapped to their guest user identities (e.g., their UPN in your tenant) and grant them read-only permissions (e.g., db_datareader role). This approach respects the isolation of the partner's tenant while enabling access through your tenant's identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Invite the consultants as guest users in your Microsoft Entra ID tenant using B2B collaboration, then create a contained database user for each guest user
Why this is correct
B2B collaboration brings the partner tenant's identities into your tenant as guests, which Microsoft Entra authentication can then resolve. Contained database users created from those guest identities grant read-only access scoped to the database without server-level logins.
- ✗
Create a contained database user mapped to the consultants' Microsoft Entra ID user principal names (UPNs)
Why it's wrong here
Contained database users mapped to UPNs only resolve identities in the database's own Microsoft Entra ID tenant, so partner-tenant consultants cannot authenticate. It is tempting because contained users simplify permissions, but cross-tenant access requires an external user or group created in your tenant first.
- ✗
Configure Azure SQL Database to trust the partner's Microsoft Entra ID tenant
Why it's wrong here
Azure SQL Database only supports Microsoft Entra ID authentication against its own tenant; guest accounts must be invited into that tenant first. Trusting a partner tenant directly is not a supported configuration. It tempts because cross-tenant federation exists for other Microsoft services, but SQL Database requires the consultant identities to reside as guests in your tenant.
- ✗
Create a SQL Server authentication login and user for the consultants
Why it's wrong here
SQL Server authentication logins are separate credentials unrelated to Microsoft Entra ID, so they bypass the tenant-based authentication the environment uses and cannot represent partner identities. They are tempting for quick access, but external consultants from another tenant need Microsoft Entra ID external users or groups.
Go deeper
Related to this question
Learn chapter
Managing Identity and Access for Azure SQL
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 574-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.