Question

You manage an Azure SQL Database that uses Microsoft Entra authentication. A contractor's Entra ID account was deleted after their engagement ended, but you notice their database user still appears in sys.database_principals with an object-level GRANT on a sensitive schema. You want to remove all access this principal had, following least-privilege best practices, while ensuring the schema's other permissions remain intact. What should you do?

Accepted Answer

Execute DROP USER for the orphaned database user, which removes the principal and its associated permissions from the database.

Answer

Run ALTER USER on the principal to remap it to the Entra service principal, then leave the GRANT in place.

Answer

Disable SQL authentication at the server level to invalidate the contractor's credentials.

Answer

Add a DENY on the sensitive schema to the orphaned user to override the existing GRANT.