How Do You Enforce Microsoft Entra-only Authentication on Azure SQL Server1?
You have an Azure SQL Database logical server named Server1 that contains a database named DB1. You need to configure authentication for Server1 to meet the following requirements: SQL authentication cannot be used for any databases on Server1. The solution must be enforced centrally at the server level. What should you do?
Community Insight
The exam tests server-level enforcement of Entra-only authentication; the trap is selecting a Microsoft Entra administrator, which enables Entra login but leaves SQL authentication available.
This SC-500 question tests how to centrally disable SQL authentication for an Azure SQL logical server. The correct setting is Microsoft Entra-only authentication on Server1, not merely adding an Entra administrator or removing DB1 logins.
Many learners choose A, configuring a Microsoft Entra administrator, because it sounds identity-related, but that does not disable SQL authentication for all databases on Server1.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Entra-only authentication is a logical-server-level setting for Azure SQL Database that, when enabled, disables SQL authentication for every database on Server1. That directly satisfies both stated requirements: SQL authentication cannot be used and enforcement is central at the server level. Configuring a Microsoft Entra administrator is typically a prerequisite, but the Entra-only toggle is the control that actually blocks SQL logins server-wide. This is why C, not A, is the decisive configuration.Why the Other Options Are Wrong
A only adds a Microsoft Entra administrator; it enables Entra authentication but does not prevent SQL authentication from continuing to work. B enables a managed identity, which is for Azure resource access and does not govern interactive user authentication to DB1. D is database-scoped and incomplete: removing existing SQL logins from DB1 neither blocks SQL authentication at the server level nor covers other databases on Server1. None of these options enforces the "SQL authentication cannot be used" requirement centrally.Community Comment Notes
Eltooth links to Microsoft's authentication-azure-ad-only-authentication documentation and identifies C as the answer. DaniloGreg describes the requirement as double—block SQL authentication completely and do it centrally at the logical-server level—and explains that the Entra-only toggle is designed for exactly that. Samsamie reinforces the server-versus-database distinction, noting "it said centrally, so it cannot be the db itself" and steering toward a server-level authentication option. The community consensus therefore aligns with the technical reading of the question.Official Reference
Exam Strategy
When the requirement says centrally at the server level, eliminate database-scoped choices such as D immediately. Look for the Azure SQL logical-server feature whose name explicitly states Entra-only authentication, because merely adding an Entra admin (A) leaves SQL authentication enabled.
Frequently Asked Questions
Why doesn't configuring a Microsoft Entra administrator alone disable SQL authentication?
An Entra admin enables Microsoft Entra logins, but SQL logins and SQL authentication remain available unless Entra-only authentication is enabled on the logical server.
Does Microsoft Entra-only authentication apply to every database on Server1?
Yes. It is a logical-server-level setting that blocks SQL authentication for all databases on Server1, rather than requiring a per-database change in DB1.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →