How should Azure SQL elastic jobs access a target database with Conditional Access?
Short answer
D a user-assigned managed identity
Question
Key Takeaways
The question tests the intersection of elastic job authentication and Conditional Access support; the trap is assuming any managed identity or SQL credential is sufficient, when only a user-assigned managed identity can be bound to Conditional Access policies.
Azure SQL elastic jobs require a credential to connect to target databases, and when location-based Conditional Access policies must be honored, a user-assigned managed identity is the correct choice because it integrates with Microsoft Entra ID and supports Conditional Access.
Common mistake: Many candidates choose system-assigned managed identity (A) because it is simpler to configure, but system-assigned identities cannot be independently targeted by Conditional Access policies, which require a user-assigned identity.
Expert Analysis
Why the Answer Is Correct
A user-assigned managed identity (D) is a standalone Microsoft Entra ID object that can be directly referenced in Conditional Access policies, including location-based restrictions. Elastic jobs can authenticate to Azure SQL using this identity via contained database users mapped to the managed identity. This satisfies both the elastic job requirement and the Conditional Access requirement.
Why the Other Options Are Wrong
Option A (system-assigned managed identity) is tied to the lifecycle of the job agent resource and cannot be independently targeted by Conditional Access policies. Option B (Azure SQL sign-in credentials) relies on SQL authentication, which bypasses Microsoft Entra ID entirely and therefore cannot honor Conditional Access. Option C (database-scoped credentials) is a legacy mechanism that stores SQL credentials inside the database and also cannot integrate with Conditional Access.
Community Comment Notes
Comment [1] correctly highlights the key phrase "location-based Conditional Access policies" as the deciding factor. Comment [2] reinforces that only a user-assigned managed identity leverages Microsoft Entra ID in a way that Conditional Access can evaluate. Comment [3] simply confirms D as the correct choice.
Official Reference
- https://learn.microsoft.com/en-us/azure/azure-sql/database/elastic-jobs-overview?view=azuresql
- https://learn.microsoft.com/en-us/azure/azure-sql/database/elastic-jobs-tsql-create-manage?view=azuresql
- https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question mentions Conditional Access, always look for the option that integrates with Microsoft Entra ID as an independent identity object. System-assigned identities and SQL credentials cannot be evaluated by Conditional Access policies, so user-assigned managed identity is the only valid choice.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
2f5c7cd 👍 2 Answered D"The solution must support the use of location-based Conditional Access policies"
-
JamC 👍 1 Answered DAnswer is D as it best allows you to leverage Azure AD/Microsoft Entra.
-
Mtour 👍 1 Answered Da user-assigned managed identity
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DP-300 Questions
Access 105 questions with complete answers and detailed explanations.
View Full DP-300 Practice Test →