You create five Azure SQL Database instances on the same logical server. In each database, you create a user for an Azure Active Directory (Azure AD)…

The "login error" indicates that User1 cannot authenticate at the logical server level. In Azure SQL Database, server-level principals for Azure AD identities are created as users in the virtual master database. The scenario describes User1 as a contained database user within five specific databases, which only grants access when connecting directly to those databases. To connect to the logical server itself and view all databases, User1 must have a user account in the master database. Creating this user resolves the authentication error and, by default, grants the necessary permissions to query sys.databases to see all databases on the server.

B. Assign User1 the dbdatareader role for the master database.

This is incorrect because you cannot assign a role to a user that does not exist. The primary issue is the login failure, which must be resolved by first creating the user in master.

C. Assign User1 the dbdatareader role for the databases that Userl creates.

This is incorrect because permissions within a user database do not resolve a server-level authentication failure or provide visibility into other databases on the same server.

D. Grant select on sys.databases to public in the master database.

This is incorrect because it only addresses viewing databases but does not solve the fundamental problem: User1 cannot authenticate to the server, so the login error will persist.

1. Microsoft Documentation

"Contained database users - Make your database portable": This document explains that to connect to an Azure SQL Database server

a user must have an account in the master database. It states

"An Azure AD user that is created in the master database can log into any database on that Azure SQL Database server

but will only have permissions in the master database

and any other database where the same user is created." This confirms that creating the user in master is the required step for server-level login.

Source: Microsoft Docs

"Tutorial: Create and use Azure Active Directory server logins with Azure SQL". Section: "Create a contained database user in master".

2. Microsoft Documentation

"CREATE USER (Transact-SQL)": The documentation for Azure SQL Database specifies that creating a user from an external provider (like Azure AD) in the master database effectively creates a server-level principal. This principal is required for server-level authentication.

Source: Microsoft Docs

CREATE USER (Transact-SQL). Section: "Permissions for Azure SQL Database and Azure Synapse Analytics".

3. Microsoft Documentation

"sys.databases (Transact-SQL)": The documentation for this catalog view explains its behavior in Azure SQL Database. "In the master database

this view returns the information on the master database and all user databases on the server." To query this view in master

a user must first be able to connect

which requires a user account in master.

Source: Microsoft Docs

sys.databases (Transact-SQL). Section: "Permissions for Azure SQL Database".