The Entra admin can connect to lock-lab Azure SQL, but the lock-lab analysts cannot. What should you create so the analysts’ Entra security group can sign in with least privilege?
Select an answer to reveal the explanation.
Short Explanation
The Entra admin unlocked the building; the analysts still need badges. Map their Entra security group to a contained database user (or MI login) and hand out only the SQL rights they actually use.
Full Explanation
After a Microsoft Entra administrator is configured, you create database principals from Entra users or security groups—typically contained database users on Azure SQL Database, or the managed-instance pattern for server-level logins—then grant least-privilege SQL permissions. Directory Global Administrator is not the least-privilege path into a database. Sharing the SQL admin password and using masking alone do not establish authenticated principals for the group.