How Do You Enforce Microsoft Entra-only Authentication on Azure SQL Server1?

SC-500 By islever Editorial Last updated

Implement security for databases Secure access to resources by using Microsoft Entra ID

Short answer

C Enable Microsoft Entra-only authentication on Server1 to centrally disable SQL authentication for all databases on the Azure SQL logical server.

Question

You have an Azure SQL Database logical server named Server1 that contains a database named DB1.
You need to configure authentication for Server1 to meet the following requirements:
SQL authentication cannot be used for any databases on Server1.
The solution must be enforced centrally at the server level.
What should you do?
  1. Configure a Microsoft Entra administrator for Server1.
  2. Enable a managed identity for Server1.
  3. Enable Microsoft Entra-only authentication for Server1. Correct Answer
  4. Remove SQL logins from DB1.

Key Takeaways

The exam tests server-level enforcement of Entra-only authentication; the trap is selecting a Microsoft Entra administrator, which enables Entra login but leaves SQL authentication available.

This SC-500 question tests how to centrally disable SQL authentication for an Azure SQL logical server. The correct setting is Microsoft Entra-only authentication on Server1, not merely adding an Entra administrator or removing DB1 logins.

Common mistake: Many learners choose A, configuring a Microsoft Entra administrator, because it sounds identity-related, but that does not disable SQL authentication for all databases on Server1.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra-only authentication is a logical-server-level setting for Azure SQL Database that, when enabled, disables SQL authentication for every database on Server1. That directly satisfies both stated requirements: SQL authentication cannot be used and enforcement is central at the server level. Configuring a Microsoft Entra administrator is typically a prerequisite, but the Entra-only toggle is the control that actually blocks SQL logins server-wide. This is why C, not A, is the decisive configuration.

Why the Other Options Are Wrong

A only adds a Microsoft Entra administrator; it enables Entra authentication but does not prevent SQL authentication from continuing to work. B enables a managed identity, which is for Azure resource access and does not govern interactive user authentication to DB1. D is database-scoped and incomplete: removing existing SQL logins from DB1 neither blocks SQL authentication at the server level nor covers other databases on Server1. None of these options enforces the "SQL authentication cannot be used" requirement centrally.

Community Comment Notes

Eltooth links to Microsoft's authentication-azure-ad-only-authentication documentation and identifies C as the answer. DaniloGreg describes the requirement as double—block SQL authentication completely and do it centrally at the logical-server level—and explains that the Entra-only toggle is designed for exactly that. Samsamie reinforces the server-versus-database distinction, noting "it said centrally, so it cannot be the db itself" and steering toward a server-level authentication option. The community consensus therefore aligns with the technical reading of the question.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication

This link opens the official vendor documentation in a new tab.

Exam Strategy

When the requirement says centrally at the server level, eliminate database-scoped choices such as D immediately. Look for the Azure SQL logical-server feature whose name explicitly states Entra-only authentication, because merely adding an Entra admin (A) leaves SQL authentication enabled.

Frequently Asked Questions

Why doesn't configuring a Microsoft Entra administrator alone disable SQL authentication?

An Entra admin enables Microsoft Entra logins, but SQL logins and SQL authentication remain available unless Entra-only authentication is enabled on the logical server.

Does Microsoft Entra-only authentication apply to every database on Server1?

Yes. It is a logical-server-level setting that blocks SQL authentication for all databases on Server1, rather than requiring a per-database change in DB1.

More SC-500 FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Eltooth 👍 5 Answered C
    C is correct answer. https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication
  2. DaniloGreg 👍 2 Answered C
    El requisito clave es doble: bloquear SQL authentication completamente Y que sea centralizado a nivel de servidor (no por base de datos individual). La opción "Microsoft Entra-only authentication" es justo la funcionalidad diseñada para esto — es un toggle a nivel de logical server que, una vez habilitado, deshabilita SQL authentication para todas las bases de datos del servidor, sin necesidad de tocar cada base de datos por separado.
  3. Samsamie 👍 2 Answered C
    it said centrally, so it cannot be the db itself, choose the options with "Server" and also authentication in its option...

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Is Get Agent Unavailable for an Intune Security Copilot Agent?

S-grade

How Should App1 Access Azure Files Without Storage Account Keys?

S-grade

Can VM Security Group Membership Grant Storage Access?

S-grade

Can Agent ID Developer PIM Settings Be Shortened to Two Days?

S-grade

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide