mediumMultiple Choice
SC-100 Practice Question: Deploying Azure SQL Database with Microsoft Entra…
A company is deploying Azure SQL Database with Microsoft Entra ID authentication for their application. They want to ensure that only specific Microsoft Entra ID users can access the database, and that these users are authenticated at the database level. What should they do?
⚠ Common exam trap
It's easy for candidates to confuse server-level Microsoft Entra ID admin assignment (which enables Microsoft Entra ID authentication at the server level) with the ability to control specific user access at the database level, leading them to select Option B instead of understanding that contained database users are required for granular, database-scoped authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create contained database users mapped to Microsoft Entra ID identities
Contained database users in Azure SQL Database are authenticated directly at the database level using Microsoft Entra ID identities, without requiring a server-level login. This allows you to grant access to specific Microsoft Entra ID users or groups while enforcing authentication within the database itself, aligning with the requirement for database-level authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a server-level login for each user
Why it's wrong here
Server-level logins are authenticated against the logical SQL server, not against an individual database. To use Microsoft Entra ID identities, you must create contained database users in each database; server-level logins either require SQL authentication (username/password) or are reserved for the Microsoft Entra ID admin, so they do not enable per-user Microsoft Entra ID authentication for a specific database.
- ✗
Assign the Microsoft Entra ID admin to the SQL server
Why it's wrong here
Assigning an Microsoft Entra ID admin to the SQL server grants that identity the sysadmin role on the logical server, giving full control over all databases, firewall settings, and server-level resources. This is an administrative bootstrap mechanism, not a granular access-control method for individual users; it does not allow other Microsoft Entra ID users to authenticate to a database unless contained database users are explicitly created.
- ✗
Configure firewall rules to allow specific IPs
Why it's wrong here
Firewall rules control which client IP address ranges can reach the logical server, not which users can authenticate. They are purely network-layer access controls and do not identify or authorize Microsoft Entra ID identities; even if an IP is allowed, users still need a valid database user (contained database user) mapped to an Microsoft Entra ID identity to sign in.
- ✓
Create contained database users mapped to Microsoft Entra ID identities
Why this is correct
Contained database users mapped to Microsoft Entra ID identities are the correct mechanism for authenticating users at the database scope. These users are defined entirely inside the database, and Azure SQL validates their Microsoft Entra ID bearer token during login, so no server-level login is needed. This approach supports least privilege because permissions are scoped to the database, and you can map the user to an individual Microsoft Entra ID user or a group using CREATE USER ... FROM EXTERNAL PROVIDER.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.