访问多个数据库 Azure SQL

Question

I have created 2 azure security groups (Read-SQL and the second is Write-SQL) in order for them to login into multiple Azure SQL servers via SSMS using their Azure AD identity based on their group membership in order to access multiple databases on those services.

First of all I have configured an admin group on the SQL Server in our Azure tenant.

I have connected to the SQL via SSMS using my credentials and so far so good.

After that I opened a query and typed in master database

CREATE USER [SQL-READ] FROM external provider

ALTER ROLE db_datareader ADD MEMBER [SQL-READ]; 

(Did the same thing for Write-SQL)

only the user is created and no permission given with an error saying the user does not exist or I don't have permission.

I have Azure global administrator permission in Azure and I don't know why I get this error.

In the bottom line I would like that Read-SQL and Write-SQL will be able to login in to the SQL Server and have access to all databases within it as well as giving Read-SQL reading permissions and to Write-SQL writing permission.

I read a few Microsoft articles but I got even more confused since I don't know if I need to create a login or create a user or a contained user.

Please help

Thank you

Here are few screenshots for better understanding

enter image description here

enter image description here

Read the following articles but only partial success.

https://www.mssqltips.com/sqlservertip/6751/azure-ad-authentication-azure-sql-databases/

https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#create-contained-users-mapped-to-azure-ad-identities

https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview?view=azuresql

https://learn.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your-database-portable?view=sql-server-ver16

Answer 1

Whether you should create a login, user or contained user will depend on your access and security requirements. However, in Azure SQL Database, users are created per database. So, you can create the login in the master database and then you need to create the associated user in each database on that SQL Server.

This documentation gives more information on creating logins, users and contained users for Azure SQL Database.