DP-300 Implement a secure environment Practice Question
Your team uses Azure SQL Database and wants to use Microsoft Entra ID authentication. You need to create a contained database user mapped to a Microsoft Entra ID application (service principal). Which T-SQL command should you use?
⚠ Common exam trap
Many candidates confuse `CREATE LOGIN ... FROM EXTERNAL PROVIDER` (which creates a server-level principal) with `CREATE USER ... FROM EXTERNAL PROVIDER` (which creates a contained database user), leading them to select Option B when the requirement is specifically for a contained user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CREATE USER [app-name] FROM EXTERNAL PROVIDER;
`CREATE USER [app-name] FROM EXTERNAL PROVIDER` creates a contained database user mapped to a Microsoft Entra ID identity (user, group, or application) directly in the database, without requiring a server-level login. This is the required syntax for authenticating a service principal (application) in Azure SQL Database using Microsoft Entra ID authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CREATE USER [app-name] FROM LOGIN [app-name];
Why it's wrong here
This maps to a server login, not an Entra ID application.
- ✗
CREATE LOGIN [app-name] FROM EXTERNAL PROVIDER;
Why it's wrong here
This creates a server-level login, not a contained user.
- ✗
CREATE USER [app-name] WITH PASSWORD = 'password';
Why it's wrong here
This creates a SQL authenticated user, not Entra ID.
- ✓
CREATE USER [app-name] FROM EXTERNAL PROVIDER;
Why this is correct
This creates a contained user mapped to an Entra ID identity.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
Key term
Azure SQL Authentication
Azure SQL Authentication is the process of verifying a user's identity to access an Azure SQL database using either a username and password (SQL Authentication) or a Microsoft Entra ID (formerly Azure AD) identity.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.