An application connects to a single Azure SQL database to read and write customer orders. The security team wants least privilege. Which two actions meet this requirement?
Choose two.
Show answer and explanation
Answer: B and D
Least privilege means the application identity has only the permissions it needs inside the one database. A contained database user mapped to a managed identity avoids shared credentials, and granting the db_datareader and db_datawriter roles or a narrower custom role limits what that identity can do. Server admin logins and the sysadmin role give broad control over the logical server, which is far more than an order application requires.
Why the other options are wrong
- A. The server admin login has full administrative control. Placing it in an application connection string breaks least privilege and exposes a highly privileged credential.
- C. The sysadmin role is a server-level administrative role. Adding the application to it grants far more rights than reading and writing orders needs.