Question 200
A migration replaces shared SQL login credentials with a service principal but grants db_owner to avoid mapping the required read-only permissions. Which diagnostic evidence should the database administrator check FIRST?
Explanation
Correct Answer
Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures. This is the discriminating system or configuration evidence for the case. A successful token request is not sufficient if the database principal, scope or permissions are missing or the token targets the wrong resource. Corresponding approach: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions.
Incorrect Answers
Inspect sensitivity labels, masking expressions, UNMASK permissions, privileged role membership and direct query behavior across application identities. These checks primarily test Dynamic data masking classification and permission differences instead of the critical system behavior in this case. Examine: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.
Inspect login/user mapping, server principals, password policy, Entra admin configuration, directory identity, database containment and connection string authentication mode. These checks primarily test SQL authentication versus Entra and managed-instance principals instead of the critical system behavior in this case. Examine: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.
Inspect SESSION_CONTEXT usage, predicate function logic, policy state, object permissions, execution plans and cross-tenant test accounts. These checks primarily test Row-level security and ownership predicates instead of the critical system behavior in this case. Examine: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.


