When you create an Azure SQL database, which account can always connect to the database ?

When provisioning an Azure SQL logical server, the creation process mandates the setup of a server admin login using SQL authentication (a username and password). This account is a server-level principal with the highest level of administrative privileges for that logical server. It is a member of the dbmanager and loginmanager fixed server roles, allowing it to connect to any database on the server (including the master database), create new databases, and manage other logins. Because its creation is a required step, this account always exists and can always connect.

A. The Azure AD account that creates the database is an Azure Resource Manager (ARM) identity and does not automatically receive data plane permissions to connect to the database.

B. The Azure Active Directory (Azure AD) administrator is an optional configuration. A logical server can be created without an Azure AD administrator, so this account does not always exist.

C. The sa account, a default system administrator in on-premises SQL Server, is disabled in Azure SQL Database and cannot be used for connection.

1. Microsoft Learn, "Control and grant database access to SQL Database and SQL Managed Instance," Section: "Server-level principals."

"When you create a logical server, you specify a 'server admin' login with a user name and password. Using this login and password, you can authenticate to any database on that server or instance as the server-level principal." This directly supports that the server admin login can always connect.

2. Microsoft Learn, "Tutorial: Create a single database - Azure SQL Database," Section: "Create a single database," Step 6.

The tutorial steps demonstrate that providing a "Server admin login" and "Password" is a mandatory field during the creation of a new Azure SQL logical server, confirming this account is always created.

3. Microsoft Learn, "Azure Active Directory authentication for SQL Server," Section: "Provision an Azure AD administrator for Azure SQL."

"The following steps show how to provision an Azure AD administrator for your server...". The language "provision" and the procedural steps confirm that setting an Azure AD admin is a separate, optional configuration, not a default.

4. Microsoft Learn, "sys.serverprincipals (Transact-SQL)," Section: "Remarks."

The documentation notes for Azure SQL Database that "The sa login is a server-level principal created during provisioning. It is disabled for login...". This confirms the sa account cannot be used to connect.