update

JulianePadrao · JulianePadrao · commit 455bd7573884 · 2025-02-25T14:35:31.000-06:00
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/1-introduction.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/1-introduction.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Introduction
   description: "Introduction"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/2-describe-active-directory.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/2-describe-active-directory.yml
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/3-describe-authentication-identities.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/3-describe-authentication-identities.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Describe authentication and identities
   description: "Describe authentication and identities"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/4-describe-security-principals.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/4-describe-security-principals.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Describe Security Principals
   description: "Describe Security Principals"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/5-describe-database-object-permissions.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/5-describe-database-object-permissions.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Describe database and object permissions
   description: "Describe database and object permissions"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/6-identify-authentication-and-authorization.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/6-identify-authentication-and-authorization.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Identify authentication and authorization failures
   description: "Identify authentication and authorization failures"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/7-exercise-authorize-access-sql-database-azure-active-directory.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/7-exercise-authorize-access-sql-database-azure-active-directory.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: 'Exercise: Authorize Access to Azure SQL Database with Microsoft Entra ID'
   description: "Exercise: Authorize Access to Azure SQL Database with Microsoft Entra ID"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/8-knowledge-check.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/8-knowledge-check.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Knowledge check
   description: "Knowledge check"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/9-summary.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/9-summary.yml
@@ -6,8 +6,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Summary
   description: "Summary"
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: unit
 azureSandbox: false
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/1-introduction.md b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/1-introduction.md
@@ -1,13 +1,12 @@
-Azure SQL Database has several authentication and authorization options which are different from the options in SQL Server. This is because Azure SQL Database and Azure SQL Managed Instance rely on Microsoft Entra ID instead of Windows Server Active Directory.
+Azure SQL offerings provide several authentication and authorization options that differ from those in SQL Server. This is because Azure SQL Database and Azure SQL Managed Instance rely on Microsoft Entra ID instead of Windows Server Active Directory.
 
-This module explores the practices of granting permissions and what the various permissions do within a database. This module also explores the concept of “least privilege”. While the built-in roles in SQL Server and other database engines provide broad brushes of security privileges, many applications need more granular security on database objects.
+This module explores best practices for granting permissions and the various permissions available within a database. It also delves into the concept of *least privilege*. While built-in roles in SQL Server and other database engines offer broad security privileges, many applications require more granular security on database objects.
 
 ## Learning objectives
 
 In this module you will learn about:
 
-- Describe the differences between Active Directory and Microsoft Entra ID
-- Explain authentication Options for Azure SQL Database
+- Explain authentication options for Azure SQL offerings
 - Describe security principals
 - Explain object permissions
 - Identify authentication and authorization failures
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/2-describe-active-directory.md b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/2-describe-active-directory.md
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/3-describe-authentication-identities.md b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/3-describe-authentication-identities.md
@@ -1,17 +1,23 @@
-Both on-premises SQL Server installations and SQL Server installations within Azure Virtual Machines support two modes of authentication: SQL Server authentication and Windows Authentication. When using SQL Server authentication, SQL Server-specific login name and password information is stored within SQL Server, either in the master database, or in the case of contained users, within the user database. Using Windows Authentication, users to connect to the SQL Server using the same Active Directory account they use to log into their computer (as well as accessing file shares and applications).
+Both on-premises SQL Server and SQL Server in Azure VMs support SQL Server authentication and Windows Authentication. SQL Server authentication stores login details within SQL Server, while Windows Authentication uses Microsoft Entra ID (formerly Active Directory) accounts.
 
-Active Directory authentication is considered to be more secure because SQL Server authentication allows for login information to be seen in plain text while being passed across the network. In addition, Active Directory authentication makes it easier to manage user turnover. If a user leaves the company and you use Windows authentication, the administrator would only have to lock the single Windows account of that user, instead of identifying each occurrence of a SQL login.
+Microsoft Entra ID authentication is more secure and simplifies user management. If a user leaves, only the Microsoft Entra ID account needs to be locked.
 
-Azure SQL Database similarly supports two different modes of authentication, SQL Server authentication and Microsoft Entra authentication. SQL Server authentication is the same authentication method that has been supported in SQL Server since it was first introduced, where user credentials are stored within either the master database or the user database. Authentication via Microsoft Entra ID allows the user to enter the same username and password, which is used to access other resources such as the Azure portal or Microsoft 365.
+Azure SQL Database also supports SQL Server authentication and Microsoft Entra authentication. Microsoft Entra authentication uses the same credentials for other resources like the Azure portal or Microsoft 365.
 
-As mentioned above, Microsoft Entra ID can be configured to sync with the on-premises Active Directory. This option allows users to have the same usernames and passwords to access on-premises resources as well as Azure resources. Microsoft Entra ID adds on additional security measures by allowing the administrator to easily configure multi-factor authentication (MFA).
+Microsoft Entra ID can sync with on-premises Active Directory, providing consistent credentials for both environments. It also supports multi-factor authentication (MFA) for added security. MFA options include push notifications via the Microsoft Authenticator app, text messages, or access codes. Users with MFA must use the Universal Authentication with MFA option in SQL Server Management Studio.
 
-With MFA enabled on an account, after the correct username and password is supplied, a second level of authentication is required. By default, MFA can be configured to use the Windows Authenticator application, which will then send a push notification to the phone. Additional options for the default MFA action include sending the recipient a text message with an access code, or having the user enter an access code that was generated with the Microsoft Authenticator application. If a user has MFA enabled, they have to use the Universal Authentication with MFA option in Azure Data Studio and SQL Server Management Studio.
+You can set SQL admin permissions on an Azure SQL Database using the Azure portal.
 
-:::image type="content" source="../media/module-33-security-final-01.png" alt-text="Universal Authentication in SQL Server Management Studio":::
+:::image type="content" source="../media/module-33-security-final-02.png" alt-text="Screenshot showing how to set admin permissions on a SQL Database.":::
 
-Both Azure SQL Database for SQL Server and Azure Database for PostgreSQL support configuring the server that is hosting the database to use Microsoft Entra authentication.
+It is a best practice to make this account a Microsoft Entra group, so access is not dependent on a single login. The Microsoft Entra admin account grants special permissions and allows the account or group that holds that permission to have `sysadmin` like access to the server and all of the databases within the server. The admin account is only set using Azure Resource Manager and not at the database level. In order to change the account or group, you have to use the Azure portal, PowerShell, or Azure CLI.
 
-:::image type="content" source="../media/module-33-security-final-02.png" alt-text="Microsoft Entra Admin Configuration for Azure SQL server":::
+## Role-based access control
 
-This login allows the admin access to all of the databases in the server. It is a best practice to make this account a Microsoft Entra group, so access is not dependent on a single login. In the above image, that group has been called DBA team. The Microsoft Entra Admin account grants special permissions and allows the account or group that holds that permission to have sysadmin like access to the server and all of the databases within the server. The admin account is only set using Azure Resource Manager and not at the database level. In order to change the account or group, you have to use the Azure portal, PowerShell, or CLI.
+All Azure types of operations for Azure SQL Database are controlled through role-based access control (RBAC). RBAC is currently decoupled from Azure SQL security, but you can think of it as security rights outside of your database in SQL Database, with a scope that includes subscription, resource group, and resource. The rights apply to operations in the Azure portal, the Azure CLI, and Azure PowerShell. RBAC allows for separation of duties between deployment, management, and usage.
+
+Built-in roles are available to reduce the need for higher-level RBAC roles, such as **Owner** or **Contributor**. Effectively, you can use these roles to have certain individuals deploy Azure SQL resources (or manage security policies) but grant other users actual access to use or manage the database.  For example, a **SQL Server Contributor** could deploy a server and assign a user to be the admin of the server and databases. The built-in roles for Azure SQL Database include:  
+
+- **SQL DB Contributor**: Can create and manage databases but can't access the database (for example, can't connect and read data)
+- **SQL Security Manager**:  Can manage security policies for databases and instances (such as auditing) but can't access them
+- **SQL Server Contributor**: Can manage servers and databases but can't access them.
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/4-describe-security-principals.md b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/4-describe-security-principals.md
@@ -104,18 +104,18 @@ The built-in database roles do meet the needs of many applications; however with
  > [!NOTE]
  >By default, users in roles like *db_owner* can always see all of the data in the database. Applications can take advantage of encryption options like **Always Encrypted** to protect sensitive data from privileged users.
 
-Azure SQL Database has two roles that are defined in the master database of Azure SQL server.
+For Azure SQL Database, there are a few nuances. You can have logins that exist in the virtual `master` database, database users, and even contained database users for Microsoft Entra accounts (recommended). Although the server admin for Azure SQL Database essentially has `sysadmin` rights, you can create more limited admins by using server or database level roles. Two database level roles are available for SQL Database that only exist in the virtual `master` database:
 
 | Database Role | Definition |
 |------------|-------------|
-|**dbmanager** | Allows its members to create extra databases within the Azure SQL Database environment. This role is the equivalent of the `dbcreator` fixed server role in an on-premises Microsoft SQL Server. |
-|**loginmanager** | Allows its members to create extra logins at the server level. This role is the equivalent of the `securityadmin` fixed server role in an on-premises Microsoft SQL Server. |
+|**dbmanager** | Allows members to create logins for the database server. This role is the equivalent of the `dbcreator` fixed server role in an on-premises Microsoft SQL Server. |
+|**loginmanager** | Allows members to create and delete databases for the database server. This role is the equivalent of the `securityadmin` fixed server role in an on-premises Microsoft SQL Server. |
 
-## Fixed server roles
+## Fixed server-level roles
 
-In addition to database roles, SQL Server and Azure SQL Managed Instance both provide several fixed server roles. These roles assign permissions at the scope of the entire server. Server level principals, which include SQL Server logins, Windows accounts, and Windows group can be added into fixed server roles. The permissions for fixed server roles are predefined, and no new server roles can be added. The fixed server roles are:
+In addition to database roles, SQL Server and Azure SQL Managed Instance both provide several fixed server-level roles. These roles assign permissions at the scope of the entire server. Server-level principals, which include SQL Server logins, Windows accounts, and Windows group can be added into fixed server-level roles. The permissions for fixed server-level roles are predefined, and no new server roles can be added.
 
-| Fixed server role | Definition |
+| Fixed server-level role | Definition |
 |------------|-------------|
 |**sysadmin** |  Allows its members to perform any activity on the server.
 |**serveradmin** |  Allows its members to change server-wide configuration settings (for example Max Server Memory) and can shut down the server. |
@@ -126,3 +126,13 @@ In addition to database roles, SQL Server and Azure SQL Managed Instance both pr
 |**diskadmin** | Allows its members to have the ability to manage backup devices in SQL Server. |
 |**dbcreator** | Allows its members to create, restore, alter, and drop any database. |
 |**public** | Every SQL Server login belongs to the public user role. Unlike the other fixed server roles, permissions can be granted, denied, or revoked from the public role. |
+
+Here's a list of server-level roles in Azure SQL Database:
+
+- ##MS_DatabaseConnector##
+- ##MS_DatabaseManager##
+- ##MS_DefinitionReader##
+- ##MS_LoginManager##
+- ##MS_SecurityDefinitionReader##
+- ##MS_ServerStateReader##
+- ##MS_ServerStateManager##
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/9-summary.md b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/includes/9-summary.md
@@ -1,11 +1,11 @@
-Azure SQL Database has several authentication and authorization options which are different from the options in SQL Server. This is because Azure SQL Database and Azure SQL Managed Instance rely on Microsoft Entra ID instead of Windows Server Active Directory.
+Azure SQL offerings provide several authentication and authorization options that differ from those in SQL Server. This is because Azure SQL Database and Azure SQL Managed Instance rely on Microsoft Entra ID instead of Windows Server Active Directory.
 
-This module explored the practices of granting permissions and what the various permissions do within a database. This module also explored the concept of “least privilege”. While the built-in roles in SQL Server and other database engines provide broad brushes of security privileges, many applications need more granular security on database objects.
+This module explores best practices for granting permissions and the various permissions available within a database. It also delves into the concept of *least privilege*. While built-in roles in SQL Server and other database engines offer broad security privileges, many applications require more granular security on database objects.
 
 Now that you've reviewed this module, you should be able to:
 
-- Describe the differences between Active Directory and Microsoft Entra ID
-- Explain authentication Options for Azure SQL Database
+- Explain authentication options for Azure SQL offerings
 - Describe security principals
 - Explain object permissions
 - Identify authentication and authorization failures
+
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/index.yml b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/index.yml
@@ -5,8 +5,8 @@ metadata:
   prefetch-feature-rollout: true
   title: Configure database authentication and authorization
   description: Configure database authentication and authorization
-  ms.date: 04/26/2022
-  author: wwlpublish
+  ms.date: 02/25/2025
+  author: JulianePadrao
   ms.author: jupadrao
   ms.topic: module
   ms.service: azure
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/media/module-33-security-final-01.png b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/media/module-33-security-final-01.png
diff --git a/learn-pr/wwl-data-ai/configure-database-authentication-authorization/media/module-33-security-final-02.png b/learn-pr/wwl-data-ai/configure-database-authentication-authorization/media/module-33-security-final-02.png
