DP-300 Certification Practice Question #87

Question

You have an Azure SQL database named DB1.
A user named User1 has an Azure Active Directory (Azure AD) account.
You need to provide User1 with the ability to add and remove columns from the tables in DB1. The solution must use the principle of least privilege.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

User1 has an Azure AD account and needs to add/remove columns (DDL operations). The principle of least privilege is key. Creating a **contained database user** (B) scoped to DB1 is the recommended approach for Azure AD users in Azure SQL Database — it avoids the need for a server-level login, limiting the user's access to just that database. Assigning the **db_ddladmin** role (D) grants the ability to run DDL statements (ALTER TABLE) without the broad permissions of db_owner. This combination is confirmed by 14 community votes and MS Learn guidance on contained users.

More DP-300 practice questions