Question

You manage an Azure SQL Database used by a reporting application. A new team of five analysts needs read-only access to all tables in the database. The analysts already belong to an existing Microsoft Entra ID security group named 'sg-report-analysts'. You want to grant access following least-privilege principles while minimizing ongoing user-by-user administration. Which approach should you use?

Accepted Answer

Create a contained database user mapped to the 'sg-report-analysts' Entra group and add it to the db_datareader role.

Answer

Create individual contained database users for each analyst and grant each the CONTROL permission on the database.

Answer

Add the 'sg-report-analysts' group as a member of the db_owner role at the server master database.

Answer

Create a SQL login for each analyst and grant them the db_datawriter role in the reporting database.