DP-900 Contained database user Practice Question
You are creating an Azure SQL Database and need to connect using Microsoft Entra ID authentication. Which user type must you create in the database to represent the authenticated Microsoft Entra ID identity?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contained database user mapped to a Microsoft Entra ID identity
To authenticate using Microsoft Entra ID in Azure SQL Database, you must create a contained database user that is mapped to a Microsoft Entra ID identity. This user does not have a login in the master database but is authenticated via Entra ID. Option A is incorrect because SQL logins use SQL Server authentication, not Entra ID. Option C is incorrect because there is no concept of an 'external user' in this context; the correct term is a contained database user mapped to an Entra ID identity. Option D is incorrect because a database user without login is typically used for SQL authentication or users without a login, not for Entra ID authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL login with password
Why it's wrong here
A SQL login with password is a server-level principal that authenticates through SQL authentication, not Microsoft Entra ID. It cannot be mapped to a Microsoft Entra ID identity, so it would still require a SQL username and password when connecting. Because the requirement is to connect using Microsoft Entra ID authentication, this login type is incorrect.
- ✓
Contained database user mapped to a Microsoft Entra ID identity
Why this is correct
A contained database user mapped to a Microsoft Entra ID identity is created with CREATE USER [user] FROM EXTERNAL PROVIDER. This provisions a database-level principal that is directly tied to a user or group in Microsoft Entra ID, enabling authentication with an Entra ID access token. This is the required approach for using Microsoft Entra ID authentication with Azure SQL Database.
- ✗
External user from Microsoft Entra ID
Why it's wrong here
An external user from Microsoft Entra ID is not a recognized principal type in Azure SQL Database. Although Entra ID has external users (e.g., B2B guest accounts), the database does not have a separate 'external user' object; instead, any Entra identity must be modeled as a contained database user mapped through the FROM EXTERNAL PROVIDER syntax. Therefore, this option does not represent a valid way to establish database access.
- ✗
Database user without login
Why it's wrong here
A database user without login is a contained database user used for SQL authentication, typically created with CREATE USER ... WITH PASSWORD. It does not map to a Microsoft Entra ID identity and cannot accept Entra ID access tokens. While it is valid for SQL login scenarios, it does not satisfy the requirement to connect using Microsoft Entra ID authentication.
Go deeper
Related to this question
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.