mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Deploying Azure SQL Database with Azure Active…
A company is deploying Azure SQL Database with Azure Active Directory authentication for their application. They want to ensure that only specific Azure AD users can access the database, and that these users are authenticated at the database level. What should they do?
⚠ Common exam trap
It's easy for candidates to confuse server-level Azure AD admin assignment (which enables Azure AD authentication at the server level) with the ability to control specific user access at the database level, leading them to select Option B instead of understanding that contained database users are required for granular, database-scoped authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create contained database users mapped to Azure AD identities
Contained database users in Azure SQL Database are authenticated directly at the database level using Azure AD identities, without requiring a server-level login. This allows you to grant access to specific Azure AD users or groups while enforcing authentication within the database itself, aligning with the requirement for database-level authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a server-level login for each user
Why it's wrong here
Server-level logins are authenticated against the logical SQL server, not against an individual database. To use Azure AD identities, you must create contained database users in each database; server-level logins either require SQL authentication (username/password) or are reserved for the Azure AD admin, so they do not enable per-user Azure AD authentication for a specific database.
- ✗
Assign the Azure AD admin to the SQL server
Why it's wrong here
Assigning an Azure AD admin to the SQL server grants that identity the sysadmin role on the logical server, giving full control over all databases, firewall settings, and server-level resources. This is an administrative bootstrap mechanism, not a granular access-control method for individual users; it does not allow other Azure AD users to authenticate to a database unless contained database users are explicitly created.
- ✗
Configure firewall rules to allow specific IPs
Why it's wrong here
Firewall rules control which client IP address ranges can reach the logical server, not which users can authenticate. They are purely network-layer access controls and do not identify or authorize Azure AD identities; even if an IP is allowed, users still need a valid database user (contained database user) mapped to an Azure AD identity to sign in.
- ✓
Create contained database users mapped to Azure AD identities
Why this is correct
Contained database users mapped to Azure AD identities are the correct mechanism for authenticating users at the database scope. These users are defined entirely inside the database, and Azure SQL validates their Azure AD bearer token during login, so no server-level login is needed. This approach supports least privilege because permissions are scoped to the database, and you can map the user to an individual Azure AD user or a group using CREATE USER ... FROM EXTERNAL PROVIDER.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.