Case Study 1 - Litware, Inc Overview Litware, Inc. is a digital media company that has 500 employees in the Chicago area and 20 employees in the San Francisco area. Existing Environment Litware has…

Correct Sequence 1. From the Azure portal, create an Azure AD administrator for LitwareSQLServer1. 2. Connect to SQLDB1 by using Microsoft SQL Server Management Studio (SSMS). 3. In SQLDB1, create contained database users. --- Why This Order Step 1 - Create an Azure AD…

Submitted by kavita_s· Mar 6, 2026Secure identity and access

Question

Case Study 1 - Litware, Inc Overview Litware, Inc. is a digital media company that has 500 employees in the Chicago area and 20 employees in the San Francisco area. Existing Environment Litware has an Azure subscription named Sub1 that has a subscription ID of 43894a43-17c2- 4a39-8cfc-3540c2653ef4. Sub1 is associated to an Azure Active Directory (Azure AD) tenant named litwareinc.com. The tenant contains the user objects and the device objects of all the Litware employees and their devices. Each user is assigned an Azure AD Premium P2 license. Azure AD Privileged Identity Management (PIM) is activated. The tenant contains the groups shown in the following table. The Azure subscription contains the objects shown in the following table. Azure Security Center is set to the Free tier. Planned changes Litware plans to deploy the Azure resources shown in the following table. Litware identifies the following identity and access requirements: All San Francisco users and their devices must be members of Group1. The members of Group2 must be assigned the Contributor role to Resource Group2 by using a permanent eligible assignment. Users must be prevented from registering applications in Azure AD and from consenting to applications that access company information on the users' behalf. Platform Protection Requirements Litware identifies the following platform protection requirements: Microsoft Antimalware must be installed on the virtual machines in Resource Group1. The members of Group2 must be assigned the Azure Kubernetes Service Cluster Admin Role. Azure AD users must be to authenticate to AKS1 by using their Azure AD credentials. Following the implementation of the planned changes, the IT team must be able to connect to VM0 by using JIT VM access. A new custom RBAC role named Role1 must be used to delegate the administration of the managed disks in Resource Group1. Role1 must be available only for Resource Group1. Security Operations Requirements Litware must be able to customize the operating system security configurations in Azure Security Center. Drag and Drop Question You need to configure SQLDB1 to meet the data and application requirements. Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibits

Answer Area

Drag items

From the Azure portal, create an Azure AD administrator for LitwareSQLServer1.In SQLDB1, create contained database users.Connect to SQLDB1 by using Microsoft SQL Server Management Studio (SSMS).In Azure AD, create a system-assigned managed identity.In Azure AD, create a user-assigned managed identity.

Explanation

Correct Sequence

From the Azure portal, create an Azure AD administrator for LitwareSQLServer1.
Connect to SQLDB1 by using Microsoft SQL Server Management Studio (SSMS).
In SQLDB1, create contained database users.

Why This Order

Step 1 - Create an Azure AD administrator for LitwareSQLServer1

Azure SQL Database does not support Azure AD authentication by default. You must first designate an Azure AD admin at the server level before any Azure AD-based logins can work. This is a server-level prerequisite - without it, Azure SQL simply cannot validate Azure AD tokens. No downstream step is possible until this is done.

Technical reason: The Azure AD admin setting enables the OAuth/AAD authentication flow at the server level and grants that admin the ability to create Azure AD-backed users inside databases.

Step 2 - Connect to SQLDB1 using SSMS

Once the Azure AD admin is set, you authenticate to SQLDB1 as that admin using SSMS. You need an active, authenticated connection to the database before you can execute any T-SQL DDL statements inside it. SSMS is the tool used to run CREATE USER ... FROM EXTERNAL PROVIDER syntax.

Technical reason: Contained database users are created via T-SQL commands, which require a live database session. You cannot create them through the Azure portal GUI.

Step 3 - Create contained database users in SQLDB1

With an authenticated session open, you run:

CREATE USER [[email protected]] FROM EXTERNAL PROVIDER;

This maps Azure AD identities (users or groups) directly to the database without requiring SQL logins at the server level - hence "contained."

Technical reason: Contained database users are scoped to the database, not the server, and are the correct mechanism for per-database Azure AD access.

Common Mistakes / Misconceptions

Mistake	Why It's Wrong
Trying to create contained users before setting the AAD admin	Will fail - AAD auth is not enabled on the server yet
Choosing "create user-assigned managed identity"	Managed identities are for application-to-Azure-service auth (e.g., an app accessing Key Vault), not for configuring AAD logins on SQL DB
Choosing "create system-assigned managed identity"	Same misunderstanding - this is about Azure resource identity, not SQL DB user configuration
Reversing steps 2 and 3	Step 3 requires an open SSMS connection, so step 2 must come first

The managed identity options are distractors targeting candidates who confuse "Azure AD authentication for SQL" with "managed identity for application access."

Topics

#Azure SQL Database#Azure AD Authentication#Database Security#SQL Server Management Studio

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice