Question
You have an Azure SQL Database logical server named Server1 that contains multiple databases.
The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases.
You need to ensure that SQL authentication is denied for connections.
What should you do?
- A. Run create USER ... FROM EXTERNAL PROVIDER on each database.
- B. Create a Conditional Access policy.
- C. Enable Microsoft Entra-only authentication for Server1. Correct
- D. Assign the SQL Server Contributor role to Server1.
Explanation
Enabling Microsoft Entra-only authentication disables SQL authentication at the server level, so no SQL authentication login or user can connect to Server1 or any of its databases. It does not remove the existing SQL logins and users; it only stops them from connecting, which is exactly what is required. Creating users from the external provider adds Entra users but leaves SQL authentication working. Conditional Access applies to Microsoft Entra sign-ins, not SQL authentication, and SQL Server Contributor is a role for managing servers that cannot even change this setting.
