Deployment issues when publishing Azure SQL database using Azure SQL Dacpack task in Azure pipelines within an agent job

Question

I am trying to publish Azure SQL database using Azure SQL Dacpack task in Azure pipelines within an agent job. The authentication type I am using to publish is Service Principal.

I have added service principal as a contained DB user in the Azure SQL database and have given db owner permissions to service principal. When Service principal is a member of Active Directory Admin of Azure SQL Server, the deployment works fine. But, when Service principal is not a member of Active Directory Admin of Azure SQL Server, the deployment fails.

The error that I get is:

Unable to connect to target server. Please verify the connection information such as the server name, login credentials, and firewall rules for the target server. + Login failed for user '< token-identified principal>'. The Azure SQL DACPAC task failed. SqlPackage.exe exited with code 1.

Security team in my organization is not allowing me to have SP as Active Directory Admin of Azure SQL Server.

Answer 1

Azure SQL database only allow server admin/AD admin account to restore/backup the database. That's the permission limit and we can't change it.

Like you said, only if the service principal is a member of Active Directory Admin of Azure SQL Server, the account has the permission restore the database from.BACPAC file.

HTH.