Server identity does not have the Microsoft Entra Directory Readers permission.

Question

Server identity does not have the Microsoft Entra Directory Readers permission.

Daniel Martinez 40

I'm using a Service Principal that creates an SQL Server with an SMI (System-assigned managed identity) in an Azure DevOps pipeline, and then runs an .sql file with the SQL Server's SMI.

I made sure that the SMI has the following permissions in Azure: User's image

I granted most permissions and will start removing unnecessary permissions once my pipeline works.

However, when I want to run an .sql file containing some "CREATE USER" statements, it fails with the following error:

IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'my-app-api')
BEGIN
    CREATE USER [my-app-api] FROM EXTERNAL PROVIDER
END

Server identity does not have the Microsoft Entra Directory Readers permission. For more information, see https://go.microsoft.com/fwlink/?linkid=2323204.

I'm confused since the article "Directory Readers role in Microsoft Entra ID for Azure SQL" suggests looking for "Managed identities in Microsoft Entra for Azure SQL" and assign discrete Graph permissions like I did, instead of assigning the Entra ID role Directory Readers.

This external blog uses discrete permissions (e.g. "User.Read.All", "Group.Read.All", etc.) so that the SQL SMI can create users in the database, and it works for them!

https://blog.rufer.be/2025/02/27/howto-fix-server-identity-does-not-have-azure-active-directory-readers-permission-error-when-using-terraform-local-exec-provisioner-to-create-sql-database-users-from-external-provider-in-a-az-de/

However, in this Microsoft Learn question, the accepted answer suggests using the Directory Readers Entra ID role since nothing else works!
https://learn.microsoft.com/en-us/answers/questions/5551692/server-identity-does-not-have-the-required-permiss

Can I achieve what I want without the Entra ID role?

0 comments

2 answers

Your answer

Answer 1

Pilladi Padma Sai Manisha 10,770 Microsoft External Staff Moderator

Hi @Daniel Martinez
Yes, this can be achieved without assigning the Microsoft Entra Directory Readers role, but the key detail is that the required permissions must be granted to the Azure SQL logical server's managed identity (server identity), not to the Azure DevOps Service Principal or another managed identity used by the deployment pipeline.

When CREATE USER ... FROM EXTERNAL PROVIDER is executed, Azure SQL uses the server identity to query Microsoft Entra ID and resolve the external principal. If that identity cannot read Entra objects, you'll receive the error:

Server identity does not have the Microsoft Entra Directory Readers permission.

Microsoft supports two approaches:

Assign the Directory Readers directory role to the Azure SQL server identity.
Grant the equivalent Microsoft Graph application permissions (least-privilege approach) to the Azure SQL server identity instead.

If you're using Microsoft Graph permissions, ensure they are assigned as Application permissions, admin consent has been granted, and they are assigned to the Azure SQL server's managed identity. Depending on the scenario, commonly required permissions include User.Read.All, GroupMember.Read.All, Application.Read.All, and sometimes Group.Read.All.

If you've already assigned these permissions and the error persists, verify that they were assigned to the correct identity (the SQL server identity) and allow some time for permission propagation.

While Directory Readers is not mandatory, it remains the simplest and most reliable supported option if the Graph permission approach doesn't work in your environment.

Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-06-24T02:07:17.2366667+00:00

Hi @Daniel Martinez
Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Daniel Martinez 40 Reputation points

2026-06-24T13:01:32.4166667+00:00

Hi @Pilladi Padma Sai Manisha

We granted consent on all permissions User.Read.All, GroupMember.Read.All, Application.Read.All and Group.Read.All

However, the Server SMI still can't create SQL Users in the database until we grant it Directory Readers role, so I had to use it.

Server identity does not have the Microsoft Entra Directory Readers permission. For more information, see https://go.microsoft.com/fwlink/?linkid=2323204.
Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-06-25T04:49:18.7066667+00:00

Hi @Daniel Martinez
We understand that you granted the required Microsoft Graph application permissions with admin consent, but the Azure SQL server managed identity continued to return the "Server identity does not have the Microsoft Entra Directory Readers permission" error.

Since assigning the Microsoft Entra Directory Readers role resolved the issue, it indicates that, in your environment, the server managed identity was only able to successfully resolve Microsoft Entra principals after being granted that directory role.

We appreciate you sharing the outcome of your testing. Although Microsoft documentation describes Microsoft Graph application permissions as an alternative, your experience shows that the Directory Readers role was required for your scenario.

References:

Directory Readers role in Microsoft Entra ID for Azure SQL

Managed identities in Microsoft Entra for Azure SQL
Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-06-26T06:59:32.11+00:00

Hi @Daniel Martinez
Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know

Answer 2

Erland Sommarskog 135.1K MVP Volunteer Moderator

The topic for CREATE USER, the Azure SQL version, says:

If the principal issuing the CREATE USER statement is a Microsoft Entra user principal, the principal (or principal's group) must be in the Directory Readers role in Microsoft Entra.

So the answer to your questions is: No, it can't be done.

0 comments