nerdexam
Microsoft

DP-203 · Question #62

Drag and Drop Question You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You have an Azure Synapse Analytics dedicated SQL pool named dw1 that…

The correct answer is Create a database user in dw1 that represents Group1 and uses the FROM EXTERNAL PROVIDER clause.; Create a database role named Role1 and grant Role1 SELECT permissions to schema1.; Assign Role1 to the Group1 database user. To grant an Azure AD group access to a Synapse dedicated SQL pool using least privilege, you must first create a contained database user mapped to the Azure AD group using FROM EXTERNAL PROVIDER (this links the external identity to the database). Next, create a database role…

Submitted by minji_kr· Mar 30, 2026Design and Implement Data Security - Configure authentication, authorization, and access control for Azure Synapse Analytics dedicated SQL pools using Azure Active Directory and database-level roles.

Question

Drag and Drop Question You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You have an Azure Synapse Analytics dedicated SQL pool named dw1 that contains a schema named schema1. You need to grant Group1 read-only permissions to all the tables and views in schema1. The solution must use the principle of least privilege. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select. Answer:

Exhibit

DP-203 question #62 exhibit

Answer Area

Drag items

Create a database role named Role1 and grant Role1 SELECT permissions to schema1.Create a database role named Role1 and grant Role1 SELECT permissions to dw1.Assign the Azure role-based access control (Azure RBAC) Reader role for dw1 to Group1.Create a database user in dw1 that represents Group1 and uses the FROM EXTERNAL PROVIDER clause.Assign Role1 to the Group1 database user.

Correct arrangement

  • Create a database user in dw1 that represents Group1 and uses the FROM EXTERNAL PROVIDER clause.
  • Create a database role named Role1 and grant Role1 SELECT permissions to schema1.
  • Assign Role1 to the Group1 database user.

Explanation

To grant an Azure AD group access to a Synapse dedicated SQL pool using least privilege, you must first create a contained database user mapped to the Azure AD group using FROM EXTERNAL PROVIDER (this links the external identity to the database). Next, create a database role (Role1) and grant it SELECT permissions scoped specifically to schema1 (not the entire database, which would violate least privilege). Finally, assign Role1 to the Group1 database user so the permissions flow through the role. This three-step pattern - create user, create scoped role, assign role - is the standard least-privilege approach for Azure Synapse SQL pools.

Topics

#Azure Synapse Analytics#SQL Pool Security#Azure AD Integration#Least Privilege Access Control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DP-203 Practice