Author: thedatacommunity

Create and configure GitHub Copilot instruction files (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Create and configure GitHub Copilot instruction files


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

GitHub Copilot is an AI-powered coding assistant that generates code, explains existing code, creates documentation, and assists with debugging. While Copilot is powerful out of the box, organizations often need the AI to follow company-specific standards instead of producing generic code.

GitHub Copilot instruction files provide persistent guidance to Copilot. Rather than repeatedly telling Copilot the same preferences during every chat session, developers can store instructions in version-controlled files inside the repository. They help ensure that AI-generated code follows an organization’s coding standards, security requirements, architectural patterns, naming conventions, and SQL development best practices. Candidates should understand not only how to create these files, but also how they influence Copilot’s responses.

Instruction files improve:

  • Consistency
  • Security
  • Coding standards
  • SQL development practices
  • Documentation quality
  • Team collaboration
  • AI response quality

For the DP-800 exam, understand:

  • What instruction files are
  • Where they are stored
  • What types of instructions they contain
  • How they affect Copilot responses
  • Best practices for SQL development

Why Use Instruction Files?

Without instruction files:

Developer:
Create a stored procedure.
Copilot:
Creates one using SELECT * and no error handling.

Next time:

Developer:
Remember to avoid SELECT *
Use TRY...CATCH
Use PascalCase
Include comments
Use parameters

The developer must continually repeat instructions.

With instruction files:

Repository contains instructions.
Copilot automatically follows them.

Every developer receives consistent AI assistance.


What Are GitHub Copilot Instruction Files?

Instruction files are Markdown files that contain natural-language guidance for Copilot.

They describe:

  • Coding style
  • Naming conventions
  • Architecture
  • Security practices
  • SQL standards
  • Documentation requirements
  • Testing expectations

Instead of writing prompts repeatedly, the repository permanently stores the instructions.


Benefits

Instruction files provide:

Consistency

Every developer receives similar AI suggestions.


Faster Development

Less prompt engineering.

Developers spend less time explaining requirements.


Higher Code Quality

Instructions encourage:

  • Proper formatting
  • Secure coding
  • Error handling
  • Documentation

Better Security

Organizations can require Copilot to:

  • Parameterize SQL
  • Avoid dynamic SQL
  • Validate input
  • Follow least privilege

Team Standards

New developers immediately receive guidance that matches experienced developers.


Repository-Level Instructions

Instruction files are stored with the project.

Example:

Repository
├── .github
│ copilot-instructions.md
├── Database
├── Procedures
├── Functions
└── Tables

The instructions become part of source control.

Everyone cloning the repository receives them.


What Can Instruction Files Contain?

Common guidance includes:

Coding conventions

Example

Use PascalCase for object names.
Avoid abbreviations.
Use descriptive variable names.

SQL Standards

Example

Never use SELECT *
Always qualify object names.
Always use schema prefixes.
Prefer explicit column lists.

Error Handling

Example

Always wrap stored procedures inside TRY...CATCH.
Log errors before rethrowing.

Documentation

Example

Document all procedures.
Include parameter descriptions.
Explain business rules.

Performance

Example

Avoid cursors.
Prefer set-based operations.
Use appropriate indexing.
Avoid unnecessary temp tables.

Security

Example

Always use parameterized queries.
Never concatenate SQL strings.
Validate inputs.
Follow least privilege.

SQL Example

Instruction:

Use schema dbo.
Always include SET NOCOUNT ON.
Use TRY...CATCH.
Document parameters.
Never use SELECT *.

Prompt:

Create a procedure to retrieve customers.

Generated procedure might include:

CREATE PROCEDURE dbo.GetCustomers
(
@Country NVARCHAR(50)
)
AS
BEGIN
SET NOCOUNT ON;
BEGIN TRY
SELECT
CustomerID,
CustomerName,
Country
FROM dbo.Customers
WHERE Country=@Country;
END TRY
BEGIN CATCH
THROW;
END CATCH
END;

The instructions influence the generated output.


SQL Development Standards Commonly Included

Organizations commonly include instructions such as:

  • Use schema-qualified names
  • Use explicit column lists
  • Avoid SELECT *
  • Use transactions appropriately
  • Always parameterize SQL
  • Avoid SQL injection
  • Use TRY…CATCH
  • Return meaningful errors
  • Comment complex logic
  • Format SQL consistently

Database Naming Standards

Instruction files frequently define naming conventions.

Example

Tables

SalesOrders
Customers
Invoices

Procedures

usp_GetOrders
usp_InsertCustomer

Views

vwCustomerSales

Functions

fnCalculateTax

Documentation Standards

Instructions often require:

Every procedure includes:

  • Purpose
  • Parameters
  • Return values
  • Modification history

Example

Purpose:
Returns active customers.
Parameters:
@Country
Returns:
Customer list.

Security Guidance

Instruction files often include security rules.

Examples:

Do not:

SELECT *

Do not:

EXEC(@SQL)

Do:

sp_executesql

Do:

Parameterized queries

Require:

  • Least privilege
  • Input validation
  • Data masking awareness
  • Sensitive data handling

Performance Guidance

Example instructions:

Prefer:

  • Set-based operations
  • Appropriate indexes
  • EXISTS
  • Window functions

Avoid:

  • Nested cursors
  • RBAR processing
  • Unnecessary DISTINCT
  • Scalar UDFs inside large queries

AI Prompt Consistency

Instead of writing:

Generate a procedure.
Use TRY...CATCH.
No SELECT *
Include comments.
Use PascalCase.

Simply write:

Generate a procedure.

Copilot automatically follows repository guidance.


Version Control Benefits

Instruction files are version controlled.

Benefits include:

  • Change history
  • Code reviews
  • Branch support
  • Rollback capability
  • Team collaboration

Team Collaboration

Instruction files help ensure:

Developer A

Developer B

Developer C

Copilot

Consistent code

Everyone receives similar recommendations.


Best Practices

Microsoft recommends:

  • Keep instructions concise.
  • Focus on project-specific guidance.
  • Store instruction files with the repository.
  • Update instructions as standards evolve.
  • Use clear, natural language.
  • Include coding, security, testing, and documentation expectations.
  • Review instruction files during pull requests.
  • Avoid contradictory instructions.
  • Combine repository instructions with task-specific prompts when necessary.
  • Regularly validate that generated code still meets organizational standards.

Common Mistakes

Avoid:

❌ Extremely long instruction files

❌ Conflicting rules

❌ Outdated architecture guidance

❌ Security rules that contradict current policy

❌ Generic instructions that provide little value

❌ Forgetting to update instructions after framework changes

❌ Assuming Copilot always follows instructions perfectly without human review


DP-800 Exam Tips

Candidates should know:

  • Instruction files provide persistent repository guidance.
  • They improve consistency across AI-generated code.
  • They are stored with the project and version controlled.
  • They can define coding standards, SQL conventions, security requirements, testing expectations, and documentation guidelines.
  • They reduce repetitive prompting.
  • They complement, rather than replace, user prompts.
  • Developers remain responsible for validating all AI-generated code.
  • Well-written instruction files improve code quality and team productivity.

Summary

GitHub Copilot instruction files are an important mechanism for guiding AI-generated code within a project. By defining repository-specific coding standards, security practices, documentation requirements, and SQL development conventions, organizations can improve consistency, reduce repetitive prompting, and ensure AI-generated code better aligns with business requirements. However, instruction files do not eliminate the need for developer review. AI-generated code should always be validated for correctness, performance, maintainability, and security before deployment.


Practice Exam Questions

Question 1

A development team wants GitHub Copilot to always generate SQL stored procedures that include SET NOCOUNT ON, TRY...CATCH blocks, and schema-qualified object names. What is the best way to accomplish this?

A. Add these requirements to a GitHub Copilot instruction file stored in the repository.

B. Modify SQL Server configuration settings.

C. Configure database compatibility level.

D. Enable Query Store.

Answer: A

Explanation: Repository instruction files provide persistent guidance that GitHub Copilot automatically considers when generating code.


Question 2

What is the primary purpose of a GitHub Copilot instruction file?

A. Improve SQL Server query performance.

B. Define repository-specific guidance that influences AI-generated code.

C. Store database credentials.

D. Configure Azure SQL firewall rules.

Answer: B

Explanation: Instruction files define coding conventions, security requirements, architectural guidance, and other project-specific expectations for Copilot.


Question 3

Which instruction would most directly reduce the likelihood of SQL injection vulnerabilities in AI-generated code?

A. Use uppercase SQL keywords.

B. Always include comments.

C. Always use parameterized queries and avoid dynamic SQL string concatenation.

D. Use table aliases.

Answer: C

Explanation: Parameterized queries are a primary defense against SQL injection attacks.


Question 4

A team updates its SQL naming conventions. What is the best way to ensure GitHub Copilot follows the new standards for all developers?

A. Send an email describing the new conventions.

B. Create a shared prompt document.

C. Ask every developer to memorize the standards.

D. Update the repository’s Copilot instruction file and commit the changes.

Answer: D

Explanation: Version-controlled instruction files distribute updated guidance to everyone working with the repository.


Question 5

Which guidance is most appropriate for inclusion in a GitHub Copilot instruction file?

A. Temporary debugging notes for one developer.

B. Personal keyboard shortcuts.

C. Repository-wide SQL coding standards and documentation requirements.

D. SQL Server service account passwords.

Answer: C

Explanation: Instruction files should contain reusable project guidance, never personal settings or sensitive information.


Question 6

Why are GitHub Copilot instruction files commonly stored in source control?

A. To improve SQL Server indexing.

B. To enable versioning, collaboration, and consistent AI guidance.

C. To reduce database storage.

D. To encrypt SQL scripts.

Answer: B

Explanation: Source control ensures instruction changes are tracked, reviewed, and shared across the team.


Question 7

Which statement about GitHub Copilot instruction files is correct?

A. They eliminate the need to review AI-generated code.

B. They guarantee every generated query is optimized.

C. They replace database security policies.

D. They supplement prompts by providing persistent project-specific guidance.

Answer: D

Explanation: Instruction files enhance Copilot responses but do not replace human review or additional task-specific prompting.


Question 8

A database team wants Copilot to avoid generating SELECT * statements. Where should this requirement be documented?

A. SQL Server Agent.

B. Azure Key Vault.

C. GitHub Copilot instruction file.

D. SQL Profiler.

Answer: C

Explanation: Coding conventions such as avoiding SELECT * are ideal candidates for repository instruction files.


Question 9

Which practice improves the long-term usefulness of GitHub Copilot instruction files?

A. Adding every possible coding preference.

B. Keeping instructions concise, current, and focused on project standards.

C. Storing passwords for easier AI access.

D. Avoiding updates after the initial creation.

Answer: B

Explanation: Effective instruction files are clear, maintainable, and updated as project standards evolve.


Question 10

A developer receives SQL code from GitHub Copilot that follows all repository instruction files. What should the developer do before committing the code?

A. Commit it immediately because instruction files guarantee correctness.

B. Only verify formatting.

C. Disable Copilot.

D. Review the code for correctness, performance, security, and compliance with business requirements.

Answer: D

Explanation: AI-generated code should always undergo human review, testing, and validation, even when instruction files are used.


Go to the DP-800 Exam Prep Hub main page

Configure model and Model Context Protocol (MCP) tool options in a GitHub Copilot or Copilot in Fabric chat session – Part 3 (DP-800 Exam Prep)

Part 3 – End-to-End Development Scenarios and Practice Exam Questions


This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Configure model and Model Context Protocol (MCP) tool options in a GitHub Copilot or Copilot in Fabric chat session


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Candidates should understand how AI models and MCP-enabled tools work together throughout the SQL development lifecycle—from planning and coding to testing, deployment, and optimization.


End-to-End SQL Development Workflow

The following illustrates a typical workflow for AI-assisted SQL development.

Requirements
Developer Prompt
GitHub Copilot /
Copilot in Fabric
Selected AI Model
(Optional)
Invoke MCP Tools
Retrieve Context
• Database schema
• Existing procedures
• Documentation
• APIs
• GitHub repository
Generate SQL
Developer Review
Testing
Deployment

The AI assists throughout the workflow, but the developer remains responsible for reviewing, validating, and approving the generated solution.


Scenario 1 – Designing a New Database Table

A developer receives the following requirement:

Create a Customer table with auditing columns, primary key, email uniqueness, and indexes.

Prompt

Design a Customer table for Azure SQL Database. Include an identity primary key, audit columns, email uniqueness, and indexes for common lookup operations.

AI Response

The AI generates:

  • CREATE TABLE statement
  • PRIMARY KEY constraint
  • UNIQUE constraint
  • DEFAULT values
  • indexes
  • documentation

The developer reviews:

  • naming conventions
  • data types
  • indexing strategy
  • normalization
  • storage requirements

Scenario 2 – Creating Stored Procedures

The database already contains 150 tables.

Rather than manually examining the schema, GitHub Copilot uses an approved MCP server.

Developer prompt:

Create a stored procedure that returns all active customers with orders placed within the last 90 days.

Possible MCP interactions:

  • Read Customers table
  • Read Orders table
  • Discover foreign keys
  • Retrieve indexes

The AI produces SQL using the actual schema instead of making assumptions.


Scenario 3 – Query Optimization

A report currently takes 22 seconds.

Developer prompt:

Optimize this query for Azure SQL Database.

The reasoning model determines additional information is needed.

Using MCP:

  • retrieves execution plan
  • retrieves index information
  • retrieves statistics
  • retrieves row counts

The response includes:

  • rewritten SQL
  • missing indexes
  • parameter sniffing observations
  • SARGability improvements
  • estimated performance gains

Scenario 4 – Fabric Warehouse Development

A Fabric Warehouse contains several sales tables.

Developer asks:

Explain the warehouse schema and suggest a star schema optimization.

Copilot may retrieve:

  • warehouse metadata
  • table relationships
  • documentation
  • semantic model information

The AI can recommend:

  • dimension tables
  • fact tables
  • surrogate keys
  • partitioning
  • indexing
  • warehouse best practices

Scenario 5 – Documentation Generation

Developer prompt:

Document this database.

The AI generates:

  • table descriptions
  • column summaries
  • relationship explanations
  • stored procedure documentation
  • index summaries
  • security notes

This significantly reduces documentation effort.


Scenario 6 – Legacy SQL Refactoring

A SQL Server database contains code written fifteen years ago.

Developer prompt:

Modernize this procedure using current T-SQL best practices.

The AI may recommend:

  • TRY…CATCH
  • THROW
  • CTEs
  • window functions
  • JSON functions
  • simplified joins
  • improved naming
  • reduced duplication

Scenario 7 – Code Review

Developer prompt:

Review this stored procedure.

The AI evaluates:

  • security
  • SQL injection risks
  • indexing
  • readability
  • performance
  • maintainability

Rather than replacing human review, AI serves as an intelligent reviewer.


Scenario 8 – Database Migration

An organization is migrating SQL Server databases to Azure SQL Database.

Developer prompt:

Identify compatibility issues.

The AI reviews:

  • deprecated features
  • unsupported syntax
  • compatibility level
  • indexing recommendations
  • Azure SQL best practices

Scenario 9 – Troubleshooting Errors

A deployment fails.

Developer prompt:

Explain this SQL error.

The AI:

  • interprets error messages
  • explains root causes
  • recommends fixes
  • suggests troubleshooting steps

Scenario 10 – Learning Existing Code

A new developer joins the team.

Developer prompt:

Explain this stored procedure.

The AI produces:

  • high-level summary
  • business logic
  • table relationships
  • parameter explanations
  • execution flow

This accelerates onboarding.


Choosing the Appropriate Model

Development TaskPreferred Model
Generate CRUD statementsFast model
Explain SQL syntaxBalanced model
Create stored proceduresBalanced model
Optimize execution plansReasoning model
Review securityReasoning model
Database architectureReasoning model
DocumentationFast/Balanced model
RefactoringBalanced model
Code reviewReasoning model
TroubleshootingReasoning model

Choosing MCP Tools

Not every prompt requires MCP.

Use MCP when the AI needs:

  • live database metadata
  • repository contents
  • API specifications
  • execution plans
  • documentation
  • schema information

Simple questions such as

What is a clustered index?

generally do not require MCP.

Questions like

Show indexes on my Sales table.

typically do.


Common Development Mistakes

Trusting AI Without Validation

Always review generated SQL.


Using Production Data

Avoid exposing confidential production data unnecessarily.


Ignoring Security

Never assume generated permissions are correct.


Using the Wrong Model

Simple code generation does not always require a reasoning model.


Excessive Permissions

Only enable MCP servers with appropriate permissions.


Skipping Testing

Every generated SQL statement should be:

  • reviewed
  • tested
  • validated

Best Practices

  • Write detailed prompts.
  • Specify Azure SQL, SQL Server, or Fabric Warehouse when applicable.
  • Include schema information.
  • Use reasoning models for optimization tasks.
  • Use MCP only when external context is beneficial.
  • Enable only trusted MCP servers.
  • Follow least privilege.
  • Review generated SQL before execution.
  • Validate performance with execution plans.
  • Keep human oversight throughout the development lifecycle.

DP-800 Exam Tips

Candidates should remember:

  • AI models generate responses.
  • MCP connects AI to external systems.
  • Tools perform actions.
  • Resources provide information.
  • Prompts standardize interactions.
  • Authentication determines identity.
  • Authorization determines permissions.
  • AI operates within the user’s security context.
  • Developers remain responsible for validating all AI-generated SQL.

Practice Exam Questions

Question 1

A developer wants GitHub Copilot to recommend missing indexes based on the actual structure of an Azure SQL Database instead of making assumptions.

What should the developer configure?

A. A larger context window only

B. An MCP server that can expose database metadata and indexing tools

C. A faster AI model

D. A local SQL script containing only CREATE TABLE statements

Answer: B

Explanation:

An MCP server enables GitHub Copilot to access live database metadata, including tables, indexes, and statistics. This allows recommendations based on the actual database rather than inferred information. Increasing the context window or switching to a faster model alone does not provide access to external database metadata.


Question 2

A developer needs AI assistance to analyze an execution plan for a query that runs for several minutes.

Which model type is generally the best choice?

A. Fast code-completion model

B. Lightweight autocomplete model

C. Reasoning-focused model

D. Documentation generation model

Answer: C

Explanation:

Execution plan analysis requires complex reasoning and performance optimization capabilities. Reasoning-focused models are designed to analyze execution strategies, identify bottlenecks, and recommend indexing or query improvements.


Question 3

Which MCP component performs operations such as retrieving index information or executing an approved query?

A. Resource

B. Prompt

C. Client

D. Tool

Answer: D

Explanation:

Tools perform actions. Resources provide information, prompts are reusable instructions, and clients host the AI conversation. Retrieving index information or executing approved operations is performed through tools.


Question 4

A developer asks Copilot:

Explain what this stored procedure does.

No external information is required.

What is the most likely outcome?

A. Copilot automatically invokes every available MCP server.

B. Copilot requires administrator approval.

C. Copilot cannot answer without MCP.

D. Copilot answers using the supplied SQL and its language model.

Answer: D

Explanation:

If the prompt includes all necessary information, the AI can respond using its language model without accessing external tools. MCP is used only when additional external context is needed.


Question 5

Why should organizations implement the principle of least privilege for MCP servers?

A. To increase response speed

B. To reduce the number of AI prompts

C. To limit access to only the resources required

D. To improve SQL syntax generation

Answer: C

Explanation:

Least privilege reduces security risks by ensuring that AI assistants and users have access only to the resources necessary to perform their tasks.


Question 6

Which statement best describes the relationship between an AI model and MCP?

A. MCP replaces the language model.

B. MCP generates SQL while the model manages security.

C. The language model generates responses, while MCP enables access to external tools and resources.

D. MCP is another name for GitHub Copilot Chat.

Answer: C

Explanation:

The language model performs reasoning and response generation. MCP provides standardized access to external systems, tools, and resources that supply additional context.


Question 7

A developer wants Copilot to use repository documentation, API specifications, and database schemas when generating SQL.

What feature provides this capability?

A. Larger prompt length

B. Database compatibility level

C. MCP-enabled resources

D. SQL IntelliSense

Answer: C

Explanation:

MCP resources allow AI assistants to access external information such as documentation, schemas, and specifications, improving the relevance and accuracy of generated responses.


Question 8

After AI generates a stored procedure, what should happen next?

A. Deploy directly to production.

B. Trust the AI because it selected a reasoning model.

C. Execute immediately without testing.

D. Review, validate, test, and approve the code before deployment.

Answer: D

Explanation:

AI-generated code should always undergo code review, testing, validation, and approval before being deployed to production.


Question 9

Which scenario is most likely to benefit from an MCP server?

A. Explaining the syntax of a SELECT statement

B. Defining a PRIMARY KEY

C. Retrieving the latest schema and execution statistics from a production database

D. Explaining SQL keywords

Answer: C

Explanation:

Accessing current schemas and execution statistics requires live information from an external system, making MCP the appropriate solution.


Question 10

Why might a developer choose a balanced AI model instead of a fast model?

A. Balanced models are designed to provide stronger reasoning while maintaining good response speed.

B. Balanced models eliminate the need for testing.

C. Balanced models automatically execute SQL.

D. Balanced models replace MCP servers.

Answer: A

Explanation:

Balanced models provide a compromise between speed and reasoning quality, making them well suited for tasks such as stored procedure development, code explanation, and general SQL assistance. They do not replace testing, execute SQL automatically, or substitute for MCP functionality.


Final DP-800 Summary

For this objective, remember these core concepts:

  • AI models determine how responses are generated (speed, reasoning, and coding quality).
  • MCP determines what additional information or actions the AI can access by connecting to external tools and resources.
  • Tools execute approved operations, while resources provide contextual information.
  • Authentication identifies the user, and authorization limits what the AI can access on that user’s behalf.
  • Developers remain responsible for validating, testing, securing, and approving all AI-generated SQL before deployment.

These concepts are foundational to the DP-800 exam and reflect Microsoft’s direction toward secure, AI-assisted database development.


Go to the DP-800 Exam Prep Hub main page

Configure model and Model Context Protocol (MCP) tool options in a GitHub Copilot or Copilot in Fabric chat session – Part 2 (DP-800 Exam Prep)

Part 2 – Configuring Model Context Protocol (MCP) Tool Options


This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Configure model and Model Context Protocol (MCP) tool options in a GitHub Copilot or Copilot in Fabric chat session


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

The DP-800 exam expects candidates to understand how modern AI assistants can securely interact with external tools and enterprise systems through the Model Context Protocol (MCP). Rather than being limited to answering questions from their built-in knowledge, AI assistants can use MCP to retrieve live information, interact with databases, execute approved operations, and integrate with enterprise development workflows.

Understanding MCP is becoming increasingly important because Microsoft is integrating MCP support across GitHub Copilot, Azure services, Microsoft Fabric, and other AI-powered development experiences.


Learning Objectives

After studying this article, you should be able to:

  • Explain the purpose of Model Context Protocol (MCP)
  • Understand the components of an MCP architecture
  • Differentiate between models and tools
  • Explain MCP servers, tools, resources, and prompts
  • Configure MCP tool usage within GitHub Copilot
  • Understand how Copilot in Fabric uses MCP-enabled tools
  • Recognize security implications of MCP
  • Apply governance best practices
  • Identify common DP-800 exam scenarios involving MCP

What Is Model Context Protocol (MCP)?

Model Context Protocol (MCP) is an open protocol that enables AI assistants to securely connect to external tools, applications, services, databases, and other data sources using a standardized interface.

Before MCP, AI assistants were generally limited to:

  • their training data
  • information provided in prompts
  • uploaded files
  • conversation history

With MCP, an AI assistant can also interact with external systems in real time.

For example, instead of merely explaining how to query a SQL database, an MCP-enabled assistant can:

  • inspect a database schema
  • retrieve table metadata
  • read documentation
  • query approved data sources
  • access REST APIs
  • invoke external business services

This allows AI to generate responses based on current information rather than relying solely on previously learned knowledge.


Why MCP Exists

Organizations typically use dozens or hundreds of systems, such as:

  • Azure SQL Database
  • SQL Server
  • Microsoft Fabric
  • Azure Storage
  • Azure AI Search
  • GitHub repositories
  • SharePoint
  • Microsoft Learn documentation
  • Internal APIs
  • CRM systems
  • ERP systems
  • Ticketing systems

Without MCP, each AI assistant would require custom integrations for every external system.

MCP standardizes these integrations so that AI clients can communicate with many different services using a common protocol.


High-Level MCP Architecture

A simplified architecture looks like this:

Developer
GitHub Copilot Chat
or
Copilot in Fabric
Large Language Model
Model Context Protocol
MCP Server
External Resources
• SQL Database
• Azure SQL
• REST APIs
• GitHub
• Fabric
• Documentation
• Azure AI Search

The AI model determines what information it needs, while MCP provides the standardized mechanism for retrieving that information or invoking approved tools.


Core MCP Components

Model Context Protocol consists of several key building blocks.

These include:

  • Clients
  • Servers
  • Tools
  • Resources
  • Prompts

Each plays a specific role in the overall architecture.


MCP Client

The client is the application through which the user interacts with AI.

Examples include:

  • GitHub Copilot Chat
  • Copilot in Microsoft Fabric
  • Visual Studio Code
  • Visual Studio
  • Other MCP-compatible AI clients

The client sends prompts to the language model and coordinates interactions with MCP servers when external information is required.


MCP Server

The MCP server exposes capabilities that AI assistants can use.

Rather than connecting directly to every application, the AI communicates with an MCP server that provides standardized access to approved resources and operations.

Examples include servers that expose:

  • SQL databases
  • Azure SQL Database
  • GitHub repositories
  • Documentation
  • File systems
  • REST APIs
  • Internal enterprise applications

The MCP server determines which capabilities are available and enforces any configured permissions or policies.


MCP Tools

A tool represents an action that the AI can request.

Unlike resources, which provide information, tools perform operations.

Examples include:

  • Execute SQL
  • Search a database schema
  • Create a pull request
  • Retrieve execution plans
  • Query Azure AI Search
  • Generate documentation
  • Run a deployment pipeline
  • Validate a SQL script

Tools typically accept parameters, perform an action, and return structured results to the AI model.

Example

Suppose a developer asks:

Show me the indexes on the Sales.Orders table.

Rather than guessing, the AI could invoke an MCP tool that queries the database metadata and returns the actual index definitions.


MCP Resources

Resources represent information that the AI can read.

Examples include:

  • SQL schemas
  • Database documentation
  • Markdown files
  • JSON configuration files
  • API specifications
  • Technical documentation
  • Data dictionaries
  • Knowledge bases

Resources provide context that helps the model generate more accurate responses.

Unlike tools, resources generally do not modify data.


MCP Prompts

Prompts are reusable templates or predefined instructions that help standardize interactions with AI.

An organization might define prompts such as:

  • Generate a secure stored procedure.
  • Review SQL for performance issues.
  • Explain an execution plan.
  • Generate Azure SQL documentation.
  • Review database security.

These prompts promote consistency and help developers follow organizational standards.


How MCP Works

Consider this prompt:

Optimize my stored procedure and recommend missing indexes.

Without MCP:

The AI only analyzes the SQL text supplied by the developer.

With MCP:

The AI can:

  1. Inspect the actual schema.
  2. Read index metadata.
  3. Review execution statistics.
  4. Analyze execution plans.
  5. Recommend optimizations based on the current database.

The response becomes significantly more accurate because it is grounded in live data rather than assumptions.


Example Workflow

Developer
"Optimize this procedure"
LLM decides additional information is needed
Invoke MCP Tool
Retrieve indexes
Retrieve statistics
Retrieve execution plan
Retrieve schema
Return results to LLM
Generate optimized SQL

MCP in GitHub Copilot

GitHub Copilot increasingly supports MCP-compatible servers that allow Copilot Chat to interact with external development resources.

Depending on the environment and organizational configuration, developers can enable approved MCP servers to provide additional context during coding sessions.

Common scenarios include:

  • accessing repository metadata
  • reading project documentation
  • querying SQL schema information
  • retrieving API specifications
  • integrating with issue tracking systems
  • interacting with approved development tools

When multiple MCP servers are available, Copilot can select the appropriate server based on the user’s request and the permissions granted.


MCP in Microsoft Copilot in Fabric

Copilot in Fabric benefits from MCP by enabling AI to access enterprise data and services while respecting organizational governance.

Examples include:

  • examining Fabric Warehouse metadata
  • understanding Lakehouse schemas
  • retrieving semantic model information
  • exploring SQL endpoints
  • reading documentation
  • accessing Azure AI Search indexes
  • connecting to approved enterprise resources

This allows Copilot to produce responses that are informed by the organization’s current data landscape rather than relying solely on general knowledge.


Tool Selection

One MCP server may expose many tools.

For example:

Azure SQL MCP Server
├── List Tables
├── Execute Query
├── Show Indexes
├── Retrieve Statistics
├── Analyze Execution Plan
├── List Stored Procedures
└── Search Metadata

The AI chooses the appropriate tool based on the user’s request.


Security Model

One of MCP’s primary goals is secure interaction with enterprise systems.

Security principles include:

  • authenticated access
  • authorized operations
  • least privilege
  • explicit user consent where appropriate
  • encrypted communication
  • auditability

The AI never bypasses organizational security policies.

Instead, it operates within the permissions granted to the authenticated user and the configured MCP server.


Authentication

MCP servers generally rely on existing enterprise authentication mechanisms.

Examples include:

  • Microsoft Entra ID
  • OAuth
  • Personal Access Tokens (where appropriate)
  • Managed identities
  • Service principals

Developers should avoid embedding credentials directly in prompts or code.


Authorization

Authentication answers:

Who is the user?

Authorization answers:

What is the user allowed to do?

Even if an MCP server exposes a database, the AI can only perform operations that the authenticated user is permitted to execute.

For example:

Developer A

  • Read schema ✔
  • Read tables ✔
  • Execute SELECT ✔
  • Drop tables ✖

The AI inherits these permissions rather than receiving elevated privileges.


Least Privilege

Microsoft recommends following the principle of least privilege.

Only expose:

  • required databases
  • required APIs
  • required resources
  • approved tools

Avoid granting broad administrative access to MCP servers unless absolutely necessary.


Data Governance

Organizations should establish governance policies for AI-assisted development.

Recommendations include:

  • approve trusted MCP servers
  • monitor AI interactions
  • audit tool usage
  • classify sensitive resources
  • restrict production access
  • review generated SQL
  • require human approval for deployments

Strong governance reduces the risk of accidental exposure of sensitive information or unintended database changes.


Common Security Risks

Potential risks include:

Excessive Permissions

The AI can only be as secure as the permissions granted to it. Overly broad access increases risk.

Sensitive Data Exposure

Developers should avoid exposing confidential production data unless organizational policies permit it.

Prompt Injection

Malicious or misleading instructions embedded in external content could attempt to manipulate AI behavior. Organizations should validate trusted sources and limit exposure to untrusted content.

Unverified SQL

AI-generated SQL should always be reviewed and tested before execution.


Best Practices for Configuring MCP

  • Enable only trusted MCP servers.
  • Grant the minimum required permissions.
  • Review available tools before enabling them.
  • Use enterprise authentication mechanisms.
  • Monitor audit logs where available.
  • Validate AI-generated recommendations.
  • Restrict production resources when appropriate.
  • Keep MCP server configurations up to date.
  • Follow organizational security and compliance policies.

DP-800 Exam Tips

Remember the following points for the exam:

  • MCP is a protocol, not an AI model.
  • MCP standardizes communication between AI assistants and external tools or resources.
  • Clients (such as GitHub Copilot Chat or Copilot in Fabric) use MCP to interact with servers.
  • Servers expose tools, resources, and prompts.
  • Tools perform actions, while resources provide information.
  • AI assistants operate within the authenticated user’s permissions and do not automatically receive elevated privileges.
  • Organizations should enable only trusted MCP servers and follow the principles of least privilege, authentication, authorization, and governance.
  • Understanding the distinction between AI reasoning and externally grounded information retrieved through MCP is an important concept for DP-800.

Go to the DP-800 Exam Prep Hub main page

Configure model and Model Context Protocol (MCP) tool options in a GitHub Copilot or Copilot in Fabric chat session – Part 1 (DP-800 Exam Prep)

Part 1 – Configuring AI Models in GitHub Copilot and Microsoft Copilot in Fabric


This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Configure model and Model Context Protocol (MCP) tool options in a GitHub Copilot or Copilot in Fabric chat session


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Candidates should understand how to configure and use AI models within GitHub Copilot and Microsoft Copilot in Fabric, select the appropriate model for a task, understand the capabilities and limitations of different models, and use AI effectively when developing SQL solutions.

Unlike traditional SQL development, AI-assisted development requires understanding not only SQL syntax but also how the selected AI model influences the quality, speed, reasoning ability, and accuracy of generated code.


Learning Objectives

After studying this article, you should be able to:

  • Explain how GitHub Copilot and Copilot in Fabric use Large Language Models (LLMs)
  • Describe the role of AI models in SQL development
  • Understand model selection options
  • Compare reasoning-focused models with speed-focused models
  • Choose the appropriate model for database development tasks
  • Understand context windows and token limitations
  • Apply best practices when interacting with AI assistants
  • Recognize exam scenarios involving model configuration

AI-Assisted SQL Development

Modern SQL developers spend significant time performing repetitive tasks such as:

  • Writing CRUD statements
  • Creating stored procedures
  • Building database objects
  • Optimizing queries
  • Writing documentation
  • Generating test data
  • Troubleshooting syntax errors
  • Refactoring legacy SQL

AI assistants accelerate these activities by generating code from natural language.

Instead of writing:

CREATE TABLE Customer
(
CustomerID INT PRIMARY KEY,
FirstName NVARCHAR(100),
LastName NVARCHAR(100),
Email NVARCHAR(200)
)

A developer can simply ask:

Create a customer table with an identity primary key, email validation, audit columns, and an index on Email.

The AI model generates the initial implementation, which the developer reviews and refines.


What Is an AI Model?

An AI model is the language model responsible for interpreting prompts and generating responses.

The model determines:

  • reasoning quality
  • SQL accuracy
  • explanation depth
  • response speed
  • context understanding
  • coding capabilities

Different models are optimized for different workloads.

Some prioritize:

  • speed

Others prioritize:

  • complex reasoning

Others balance both.


GitHub Copilot Architecture

A simplified architecture looks like this:

Developer
GitHub Copilot Chat
Selected AI Model
Generated SQL
Developer Review
Database

The AI never executes SQL automatically.

The developer remains responsible for:

  • reviewing code
  • testing
  • validating security
  • validating performance

Microsoft Copilot in Fabric

Microsoft Copilot in Fabric provides AI assistance across Fabric workloads including:

  • SQL Database
  • Fabric Warehouse
  • Lakehouse
  • Data Engineering
  • Data Science
  • Power BI
  • Notebooks
  • Data Factory
  • Data Warehouse development

For SQL developers, Copilot can:

  • generate SQL
  • explain SQL
  • optimize SQL
  • summarize execution plans
  • generate documentation
  • create sample data
  • troubleshoot errors

Why Model Selection Matters

Different AI models excel at different activities.

For example:

A very fast model may generate:

SELECT *
FROM Orders

A reasoning model might instead suggest:

SELECT
OrderID,
CustomerID,
OrderDate,
TotalAmount
FROM Sales.Orders
WHERE OrderDate >= DATEADD(month,-6,GETDATE());

along with an explanation of:

  • why SELECT * should be avoided
  • indexing recommendations
  • performance implications

The reasoning model produces higher-quality guidance.


Common AI Model Characteristics

Although Microsoft continuously updates available models, most fall into these categories.

Fast Models

Optimized for:

  • rapid responses
  • autocomplete
  • simple SQL
  • syntax correction

Best for:

  • INSERT statements
  • UPDATE statements
  • CREATE TABLE
  • formatting SQL
  • documentation

Advantages

  • very fast
  • low latency
  • excellent for routine work

Disadvantages

  • less detailed reasoning
  • weaker optimization suggestions

Balanced Models

Designed for:

  • coding
  • explanation
  • optimization
  • documentation

Best for:

  • stored procedures
  • views
  • CTEs
  • joins
  • JSON
  • window functions

Advantages

  • good reasoning
  • good speed

Disadvantages

  • may not perform as well as reasoning models on complex architecture questions

Reasoning Models

Reasoning models focus on:

  • architecture
  • optimization
  • debugging
  • security
  • query analysis

Ideal for:

  • execution plans
  • indexing strategy
  • normalization
  • concurrency
  • deadlocks
  • performance tuning

Advantages

  • excellent explanations
  • identifies tradeoffs
  • strong analytical reasoning

Disadvantages

  • slower responses
  • higher computational cost

Choosing the Appropriate Model

A SQL developer should match the model to the task.

TaskRecommended Model Type
Generate CREATE TABLE statementsFast
Explain SQL syntaxBalanced
Write stored proceduresBalanced
Optimize slow queriesReasoning
Analyze execution plansReasoning
Explain indexesReasoning
Generate documentationFast
Review securityReasoning
Refactor codeBalanced
Produce examplesBalanced

Model Selection in GitHub Copilot

Depending on the supported environment and subscription, GitHub Copilot Chat allows users to select from available models.

The workflow generally involves:

  1. Open GitHub Copilot Chat
  2. Open the model selector
  3. Review available models
  4. Choose the appropriate model
  5. Continue the conversation

Changing models changes how future prompts are processed.


Example

Suppose a developer asks:

Optimize this stored procedure.

A reasoning model may return:

  • missing indexes
  • SARGability improvements
  • parameter sniffing considerations
  • execution plan observations
  • rewritten SQL

A fast model may simply reformat the SQL.


Model Selection in Microsoft Copilot in Fabric

Copilot in Fabric similarly enables AI-assisted experiences throughout Microsoft Fabric. Depending on the workload and the capabilities available to your tenant, Copilot uses supported foundation models to generate responses for SQL development, analytics, and data engineering tasks.

When working in Fabric SQL experiences, Copilot can assist with:

  • generating SQL queries
  • explaining existing queries
  • creating tables and views
  • summarizing schemas
  • troubleshooting SQL errors
  • suggesting query improvements
  • documenting database objects

Administrators control whether Copilot features are enabled for a Fabric capacity. Users with access to Copilot interact through the integrated chat interface rather than manually invoking models.


Understanding Context Windows

Every AI model has a maximum amount of information it can process at one time.

This is called the context window.

The context includes:

  • prompts
  • previous conversation
  • SQL scripts
  • schemas
  • documentation

Example:

Prompt
+
Conversation
+
Database Schema
+
SQL Script
=
Context

Larger context windows allow:

  • larger stored procedures
  • multiple tables
  • lengthy conversations
  • larger execution plans

Token Limits

Large Language Models process text as tokens rather than words.

A very large SQL script consumes more tokens than a small query.

If the context exceeds the model’s limit:

  • earlier conversation may be truncated
  • important schema details may be omitted
  • responses may become less accurate

Best practice:

Break very large SQL tasks into smaller requests.


Effective Prompting

Model quality depends heavily on prompt quality.

Poor prompt:

Fix this.

Better prompt:

Optimize this stored procedure for Azure SQL Database. Reduce logical reads while maintaining identical results.

Even better:

Optimize this stored procedure for Azure SQL Database. The Orders table contains 40 million rows. Focus on indexing recommendations, parameter sniffing, and SARGable predicates while preserving the current output.

Specific prompts produce significantly better responses.


Providing Context

Useful context includes:

  • database platform
  • compatibility level
  • schema
  • expected row counts
  • performance goals
  • business rules

Example:

Platform:
Azure SQL Database
Table:
Sales.Orders
Rows:
150 million
Goal:
Reduce CPU utilization
Current execution time:
18 seconds

The more relevant information supplied, the more useful the AI-generated recommendation.


Responsible Use of AI Models

Although AI significantly improves developer productivity, it does not replace professional judgment.

Developers should always:

  • review generated SQL
  • validate security
  • test performance
  • verify business logic
  • confirm permissions
  • review indexes
  • test edge cases

Never assume generated SQL is production-ready without validation.


Common DP-800 Exam Scenarios

The certification exam may present scenarios where you must choose the most appropriate AI model for a particular task.

Examples include:

  • Selecting a reasoning model to analyze an execution plan for a slow query.
  • Choosing a balanced model to generate and explain a stored procedure.
  • Using a fast model to quickly scaffold a set of standard CRUD statements.
  • Understanding that different models may produce different levels of explanation and optimization guidance for the same prompt.

You should also understand that AI-generated SQL should always be reviewed, tested, and validated before deployment.


Best Practices

  • Choose the model that best matches the complexity of the task.
  • Provide detailed prompts with sufficient database context.
  • Include schema information when requesting SQL generation.
  • Break very large requests into smaller, focused prompts.
  • Review all generated SQL for correctness, security, and performance.
  • Validate AI recommendations using execution plans and performance metrics.
  • Avoid sharing sensitive production data unless organizational policies explicitly allow it.
  • Remember that AI assists the developer—it does not replace testing, code review, or database design expertise.

DP-800 Exam Tips

Remember the following points for the exam:

  • AI models differ in reasoning ability, response speed, and context handling.
  • Reasoning-focused models are generally better suited for performance tuning, query optimization, and architectural guidance.
  • Simpler or faster models are appropriate for routine SQL generation and code completion.
  • The quality of AI output depends heavily on the quality of the prompt and the context provided.
  • GitHub Copilot and Copilot in Fabric accelerate development but do not automatically validate correctness or security.
  • Developers remain responsible for reviewing and testing all AI-generated SQL before deployment.

Go to the DP-800 Exam Prep Hub main page

Enable GitHub Copilot and Microsoft Copilot in Fabric (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Enable GitHub Copilot and Microsoft Copilot in Fabric


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

The DP-800 exam expects candidates to understand how to enable, configure, and effectively use GitHub Copilot and Microsoft Copilot in Microsoft Fabric to improve SQL development productivity while maintaining security, governance, and responsible AI practices.

Unlike traditional SQL development topics, this objective focuses on using AI-assisted development tools rather than writing SQL syntax itself.

After studying this topic, you should be able to:

  • Understand the purpose of GitHub Copilot and Microsoft Copilot in Fabric.
  • Identify licensing and prerequisite requirements.
  • Enable GitHub Copilot in supported development environments.
  • Enable Copilot features within Microsoft Fabric.
  • Understand tenant, capacity, and workspace requirements.
  • Use AI assistants to generate SQL code.
  • Use AI to explain, optimize, and troubleshoot SQL.
  • Understand responsible AI and governance considerations.
  • Identify security best practices when using AI-assisted development.

What is GitHub Copilot?

GitHub Copilot is an AI-powered coding assistant that helps developers write software by generating code suggestions based on natural language prompts and existing code.

It can:

  • Generate SQL queries
  • Create stored procedures
  • Suggest table definitions
  • Generate JOIN statements
  • Explain SQL code
  • Generate comments and documentation
  • Help debug errors
  • Recommend code improvements
  • Convert natural language into SQL

GitHub Copilot is integrated into popular development environments, including:

  • Visual Studio
  • Visual Studio Code
  • GitHub.com
  • Azure Data Studio (where supported)
  • SQL development environments that support Copilot extensions

For DP-800, GitHub Copilot is primarily used to accelerate SQL database development.


What is Microsoft Copilot in Fabric?

Microsoft Copilot in Microsoft Fabric is an AI assistant built directly into the Microsoft Fabric platform.

Rather than only generating code, Fabric Copilot helps users:

  • Create SQL queries
  • Build Data Warehouses
  • Generate notebooks
  • Explain SQL statements
  • Create Dataflows
  • Build reports
  • Analyze datasets
  • Summarize data
  • Generate semantic model calculations
  • Create pipelines
  • Produce documentation

For SQL developers, Copilot can assist with creating and refining SQL scripts within Fabric Data Warehouse and SQL analytics experiences.


GitHub Copilot vs. Microsoft Copilot in Fabric

FeatureGitHub CopilotMicrosoft Copilot in Fabric
Primary purposeAI coding assistantAI assistant across Fabric workloads
SQL generationYesYes
Code explanationsYesYes
Natural language promptsYesYes
Notebook assistanceLimitedYes
Data Warehouse assistanceYesYes
Power BI integrationNoYes
Fabric workspace integrationNoYes
Development IDE integrationYesLimited to Fabric experiences

GitHub Copilot Prerequisites

Before GitHub Copilot can be used, developers generally need:

  • A GitHub account
  • A GitHub Copilot subscription or enterprise license
  • A supported IDE (Visual Studio, Visual Studio Code, etc.)
  • Internet connectivity
  • Authentication with GitHub

Organizations may centrally manage Copilot licensing through GitHub Enterprise.


Enabling GitHub Copilot in Visual Studio Code

The general process includes:

  1. Install Visual Studio Code.
  2. Sign in to GitHub.
  3. Install the GitHub Copilot extension.
  4. Authenticate your GitHub account.
  5. Verify that your organization permits Copilot usage.
  6. Open a SQL file.
  7. Begin typing or enter a natural language prompt.

Example:

-- Create a stored procedure that returns all orders placed during the last 30 days.

Copilot suggests SQL code that can then be reviewed and edited.


Enabling GitHub Copilot in Visual Studio

Visual Studio includes built-in support for GitHub Copilot after the extension is installed.

Developers typically:

  • Install the GitHub Copilot extension.
  • Sign in using GitHub credentials.
  • Enable Copilot in the IDE settings if required.
  • Open a SQL project.
  • Accept or reject AI-generated suggestions.

Microsoft Fabric Copilot Requirements

Copilot in Microsoft Fabric requires several prerequisites.

These commonly include:

  • A Microsoft Fabric tenant
  • An eligible Fabric capacity that supports Copilot features
  • Administrator approval for Copilot
  • Appropriate user licensing
  • A supported Fabric experience
  • Access to a Fabric workspace

Not every Fabric environment automatically has Copilot enabled.


Enabling Copilot in Microsoft Fabric

Fabric administrators control whether Copilot features are available within the organization.

Typical steps include:

  1. Open the Fabric Admin Portal.
  2. Navigate to Tenant Settings.
  3. Locate Copilot and AI settings.
  4. Enable Copilot for the organization or selected security groups.
  5. Save configuration changes.
  6. Assign users to workspaces with Copilot-enabled capacities.

Organizations may choose to enable Copilot only for specific departments or security groups.


Workspace Considerations

Users generally require:

  • Workspace access
  • Appropriate workspace role
  • Capacity that supports AI features

Having access to Fabric alone does not guarantee Copilot availability.


Security Permissions

Fabric administrators may control:

  • Who can use Copilot
  • Which workspaces allow AI
  • Which security groups receive access
  • Which users can create AI-assisted content

This supports governance and compliance requirements.


Using GitHub Copilot for SQL Development

GitHub Copilot can assist with:

Creating Tables

Example prompt:

Create a SQL table for storing customer orders.

Copilot generates a table definition including columns, data types, and constraints.


Generating Stored Procedures

Example prompt:

Create a stored procedure that returns orders by customer.

Copilot generates the T-SQL, which should then be reviewed before deployment.


Creating Functions

Developers can request:

  • Scalar functions
  • Table-valued functions
  • Aggregate calculations
  • String manipulation
  • Date calculations

Writing Complex Queries

Copilot can generate:

  • JOIN statements
  • CTEs
  • Window functions
  • Recursive queries
  • JSON queries
  • Graph queries
  • Regular expression queries
  • Error handling logic

Using Copilot in Fabric

Fabric Copilot supports natural language interactions.

Example:

Show the top ten customers by total sales during the last fiscal year.

Copilot may generate the corresponding SQL query automatically.


Explaining SQL Code

One valuable feature is code explanation.

Example prompt:

Explain this stored procedure.

Copilot can summarize:

  • joins
  • filters
  • business logic
  • aggregations
  • performance considerations

This is especially useful when maintaining legacy SQL code.


Optimizing SQL Queries

Copilot can suggest improvements such as:

  • adding indexes
  • eliminating unnecessary scans
  • simplifying joins
  • reducing nested queries
  • replacing cursors
  • improving readability

However, recommendations should always be validated using execution plans and performance testing.


AI-Assisted Documentation

Developers can use Copilot to generate:

  • procedure descriptions
  • function documentation
  • parameter explanations
  • inline comments
  • technical documentation

Good documentation improves maintainability and collaboration.


Responsible AI Considerations

Neither GitHub Copilot nor Fabric Copilot should be considered authoritative.

Developers remain responsible for:

  • correctness
  • performance
  • security
  • compliance
  • testing
  • deployment approval

AI accelerates development but does not replace engineering judgment.


Security Best Practices

When using AI assistants:

  • Never include passwords in prompts.
  • Do not paste connection strings.
  • Remove API keys.
  • Avoid sharing production customer data.
  • Use anonymized sample data whenever possible.
  • Review generated SQL for SQL injection vulnerabilities.
  • Verify permissions follow the Principle of Least Privilege.
  • Follow organizational AI governance policies.

Common Limitations

AI assistants may:

  • Generate inefficient SQL.
  • Hallucinate nonexistent syntax.
  • Recommend deprecated features.
  • Omit indexes.
  • Produce insecure dynamic SQL.
  • Misinterpret business requirements.

Always validate generated code before using it in production.


GitHub Copilot vs Manual Development

TaskManual DevelopmentGitHub Copilot
Create SQLFully manualAI-assisted
Write documentationManualAI-generated drafts
Generate stored proceduresManualAI-assisted
Explain existing codeManual analysisAI explanations
Query optimization suggestionsDBA experienceAI recommendations (review required)
Security validationDeveloper responsibilityDeveloper responsibility

DP-800 Exam Tips

Be familiar with:

  • GitHub Copilot licensing prerequisites
  • Supported development environments
  • Fabric Copilot enablement requirements
  • Tenant settings that control Copilot
  • Workspace and capacity requirements
  • Appropriate use of AI-generated SQL
  • Responsible AI principles
  • Security and governance responsibilities
  • Human review of AI-generated code
  • Organizational approval for AI usage

Remember:

GitHub Copilot primarily assists developers inside coding environments, while Microsoft Copilot in Fabric provides AI assistance across multiple Fabric workloads, including SQL development, analytics, notebooks, and reporting.


Key Takeaways

  • GitHub Copilot is an AI-powered coding assistant that accelerates SQL development.
  • Microsoft Copilot in Fabric provides AI assistance throughout the Microsoft Fabric ecosystem.
  • Fabric administrators control Copilot availability through tenant settings and capacity configuration.
  • Developers need appropriate permissions, licensing, and workspace access.
  • AI-generated SQL should always be reviewed, tested, and validated.
  • Sensitive information should never be included in AI prompts.
  • AI improves productivity but does not replace secure software development practices.

Practice Exam Questions

Question 1

A database developer wants to use GitHub Copilot in Visual Studio Code. Which prerequisite is required before Copilot can provide code suggestions?

A. Install the GitHub Copilot extension and authenticate with a licensed GitHub account

B. Enable Microsoft Fabric capacity

C. Create a SQL Server Agent job

D. Install Azure Data Factory

Correct Answer: A

Explanation: GitHub Copilot requires a GitHub account, an appropriate Copilot license, installation of the GitHub Copilot extension, and authentication before AI-powered code suggestions become available.


Question 2

Who typically enables Microsoft Copilot features for an organization using Microsoft Fabric?

A. Every workspace member individually

B. SQL Server service account

C. Fabric administrator through tenant settings

D. Database owner

Correct Answer: C

Explanation: Microsoft Fabric administrators manage Copilot availability through tenant settings and can enable it for the entire organization or selected security groups.


Question 3

Which task is GitHub Copilot best suited to assist with?

A. Replacing SQL Server security auditing

B. Automatically approving production deployments

C. Generating SQL code and stored procedures from natural language prompts

D. Creating Azure subscriptions

Correct Answer: C

Explanation: GitHub Copilot is designed to help developers generate, explain, and improve code, including SQL statements, stored procedures, and database objects.


Question 4

A developer asks Copilot to optimize a SQL query. What should the developer do before deploying the suggested code?

A. Assume the generated code is correct

B. Skip performance testing

C. Disable indexes

D. Review, test, and validate the generated SQL

Correct Answer: D

Explanation: AI-generated code should always undergo testing, performance evaluation, security review, and validation before being used in production.


Question 5

Which Microsoft Fabric requirement is commonly necessary for users to access Copilot features?

A. Workspace access and a Copilot-supported Fabric capacity

B. SQL Server Express Edition

C. Windows Server Failover Clustering

D. SQL Server Agent enabled

Correct Answer: A

Explanation: Users generally require access to a Fabric workspace that resides on a capacity supporting Copilot features, along with the necessary permissions.


Question 6

What is an appropriate use of Microsoft Copilot in Fabric?

A. Automatically bypassing security reviews

B. Generating SQL queries from natural language requests

C. Granting database administrator privileges

D. Disabling tenant governance

Correct Answer: B

Explanation: Fabric Copilot can translate natural language requests into SQL queries and assist with other Fabric workloads, but it does not replace security or governance processes.


Question 7

Which statement best describes the relationship between GitHub Copilot and Microsoft Copilot in Fabric?

A. They perform exactly the same functions in every environment.

B. GitHub Copilot only works with Power BI.

C. Fabric Copilot replaces all integrated development environments.

D. GitHub Copilot primarily assists with coding, while Fabric Copilot assists across multiple Microsoft Fabric experiences.

Correct Answer: D

Explanation: GitHub Copilot focuses on AI-assisted software development within supported IDEs, whereas Fabric Copilot provides AI capabilities across data engineering, analytics, warehousing, notebooks, reporting, and SQL experiences.


Question 8

Which information should never be included in an AI prompt when requesting SQL assistance?

A. Sample table names

B. General business requirements

C. Production passwords and connection strings

D. Desired query output

Correct Answer: C

Explanation: Sensitive information such as passwords, connection strings, API keys, and confidential customer data should never be shared with AI tools.


Question 9

Which benefit does GitHub Copilot provide during SQL development?

A. It automatically deploys production databases.

B. It generates AI-assisted code suggestions that can improve developer productivity.

C. It permanently replaces code reviews.

D. It guarantees optimal query performance.

Correct Answer: B

Explanation: GitHub Copilot accelerates development by generating code suggestions, but developers remain responsible for testing, reviewing, and validating the generated code.


Question 10

Which statement reflects Microsoft’s recommended approach to AI-assisted database development?

A. AI-generated code should always be deployed without modification.

B. AI eliminates the need for peer reviews.

C. AI-generated code should be treated as a draft that developers validate for correctness, security, and performance.

D. AI guarantees compliance with organizational policies.

Correct Answer: C

Explanation: AI-generated code should be viewed as a productivity aid rather than authoritative output. Developers are responsible for verifying functionality, security, performance, compliance, and adherence to organizational standards before deployment.


Go to the DP-800 Exam Prep Hub main page

Interpret the security impact of using AI-assisted tools (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Interpret security impact of using AI-assisted tools


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Unlike many traditional SQL development topics, this objective focuses less on writing T-SQL and more on understanding how AI coding assistants affect security, privacy, compliance, and governance throughout the software development lifecycle.

For the DP-800 exam, you should understand:

  • Security risks associated with AI coding assistants
  • Responsible use of AI-generated code
  • Protection of confidential data
  • Compliance considerations
  • Secure prompt engineering
  • Human review requirements
  • Organizational governance for AI-assisted development
  • Microsoft AI tooling security capabilities

Why Security Matters When Using AI-Assisted Tools

Modern AI assistants such as:

  • Microsoft Copilot
  • GitHub Copilot
  • Azure AI Foundry
  • Microsoft Fabric Copilot
  • SQL Database Copilot experiences
  • Azure Data Studio AI extensions
  • Visual Studio AI-assisted development

can dramatically improve developer productivity.

However, they also introduce new risks.

AI systems often process:

  • prompts
  • source code
  • database schema
  • stored procedures
  • configuration files
  • API definitions
  • infrastructure code
  • documentation

If developers expose sensitive information to an AI system, that information could violate organizational security policies.

Therefore:

AI should improve developer productivity—not weaken database security.


Primary Security Risks

The exam expects candidates to recognize several categories of risk.

1. Exposure of Sensitive Information

Never include confidential information inside prompts.

Examples include:

  • passwords
  • connection strings
  • API keys
  • access tokens
  • customer data
  • Personally Identifiable Information (PII)
  • Protected Health Information (PHI)
  • financial records
  • encryption keys

Bad example:

“Optimize this stored procedure that accesses CustomerCreditCards.”

Better:

Replace confidential objects with generic examples.

CustomerTable
OrderTable
SalesTable

instead of production names.


2. Leakage of Intellectual Property

Many organizations consider:

  • SQL code
  • stored procedures
  • business rules
  • AI models
  • algorithms
  • database architecture

to be proprietary.

Developers should avoid submitting confidential business logic into public AI services unless organizational policy permits it.


3. AI Hallucinations

AI-generated code may:

  • invent SQL syntax
  • generate nonexistent functions
  • misuse permissions
  • recommend deprecated features
  • introduce vulnerabilities

Example:

AI may suggest:

GRANT CONTROL TO PUBLIC

This is almost never appropriate.

Always validate AI-generated SQL.


4. Insecure Code Generation

AI sometimes generates code that:

  • lacks input validation
  • uses dynamic SQL unsafely
  • ignores least privilege
  • omits error handling
  • exposes excessive permissions

Example:

Unsafe:

SET @sql =
'SELECT * FROM Orders WHERE CustomerID=' + @CustomerID
EXEC(@sql)

Preferred:

sp_executesql

with parameters.


5. Compliance Violations

Many industries have regulations governing data usage.

Examples:

  • GDPR
  • HIPAA
  • PCI DSS
  • ISO 27001
  • SOC 2

Uploading regulated information into unauthorized AI services may violate compliance requirements.


Human Review is Required

One of the most important DP-800 concepts:

AI assists developers—it does not replace secure code review.

Every AI-generated recommendation should be reviewed for:

  • correctness
  • performance
  • security
  • compliance
  • maintainability

Human approval remains essential.


Secure Prompt Engineering

Prompt engineering also has security implications.

Good prompts avoid exposing sensitive information.

Instead of:

“Here’s our production database schema.”

Use:

“Here’s a simplified example schema.”

Good prompts:

  • remove customer data
  • remove passwords
  • remove secrets
  • anonymize identifiers
  • generalize business logic

Protecting Secrets

Never place secrets into AI prompts.

Examples include:

  • Azure SQL passwords
  • Azure Storage keys
  • SAS tokens
  • API keys
  • OAuth tokens
  • certificates
  • encryption keys

Instead:

<ConnectionString>

or

<MyAPIKey>

as placeholders.


Protect Customer Data

Sensitive customer information includes:

  • names
  • addresses
  • SSNs
  • passport numbers
  • emails
  • phone numbers
  • medical records
  • payment information

Instead of:

John Smith

Use:

Customer A

Instead of:

4111-1111-1111-1111

Use:

<CardNumber>

AI and Least Privilege

Generated SQL should follow the Principle of Least Privilege.

Avoid:

GRANT CONTROL

Prefer:

GRANT SELECT

or

GRANT EXECUTE

only when necessary.

AI suggestions should always be reviewed for excessive permissions.


Verify AI-Generated Security Recommendations

AI may recommend:

  • indexes
  • permissions
  • encryption
  • authentication methods
  • firewall rules

Always verify recommendations against:

  • Microsoft documentation
  • organizational standards
  • security policies
  • current SQL Server capabilities

Secure Development Lifecycle (SDL)

AI should support—not bypass—the Secure Development Lifecycle.

Typical workflow:

  1. Developer writes prompt
  2. AI generates code
  3. Developer reviews
  4. Static code analysis
  5. Security scanning
  6. Peer review
  7. Testing
  8. Deployment

AI does not eliminate security reviews.


AI-Generated SQL Must Still Be Tested

Always test:

  • SQL injection protection
  • permissions
  • transactions
  • rollback behavior
  • concurrency
  • performance
  • indexing
  • execution plans

Never deploy AI-generated code without testing.


Microsoft Copilot Security

Microsoft enterprise AI offerings provide important security capabilities.

Examples include:

  • enterprise authentication
  • Microsoft Entra ID integration
  • tenant isolation
  • role-based access control
  • compliance features
  • auditing
  • encryption
  • responsible AI safeguards

Organizations should understand which AI services are approved for handling sensitive information.


Governance of AI Usage

Organizations should establish governance policies that define:

  • approved AI tools
  • acceptable prompts
  • prohibited data types
  • review requirements
  • logging
  • auditing
  • approval workflows
  • compliance responsibilities

Developers should follow organizational AI usage policies.


Common Security Best Practices

When using AI-assisted SQL development:

  • Never share passwords or secrets.
  • Remove customer information from prompts.
  • Anonymize production schemas when possible.
  • Validate every AI-generated query.
  • Review permissions carefully.
  • Use parameterized queries instead of string concatenation.
  • Test AI-generated code before deployment.
  • Perform peer reviews.
  • Follow organizational governance policies.
  • Verify AI recommendations against Microsoft documentation.

Exam Tips

Know the differences between:

ConceptKey Point
AI AssistanceImproves productivity but requires review
Human ReviewAlways required before deployment
Sensitive DataNever include in prompts
ComplianceAI usage must satisfy organizational regulations
SecretsNever expose passwords, keys, or tokens
Least PrivilegeAI-generated permissions should be minimal
GovernanceOrganizations define approved AI usage
Responsible AIAI outputs must be validated for security and correctness

DP-800 Exam Tips

Expect scenario-based questions such as:

  • Is this prompt safe?
  • Which information should be removed before using Copilot?
  • Which AI recommendation should be rejected?
  • Which code introduces SQL injection?
  • Which permission follows least privilege?
  • How should confidential schemas be shared?
  • What review is still required after AI generates code?
  • Which compliance issue exists?
  • Which AI-generated recommendation is safest?
  • Which governance practice should be followed?

The correct answer almost always favors:

  • protecting sensitive information,
  • minimizing permissions,
  • validating AI-generated code,
  • following organizational security policies, and
  • requiring human review before deployment.

Practice Exam Questions

Question 1

A developer wants to use an AI coding assistant to optimize a stored procedure. Which information should NOT be included in the prompt?

A. Sample table names

B. Production connection string containing credentials

C. Database version

D. Execution plan summary

Correct Answer: B

Explanation:
Connection strings containing usernames, passwords, or other credentials are sensitive secrets and should never be shared with AI tools. Replace them with placeholders before submitting prompts.


Question 2

Which security principle should always be applied when reviewing AI-generated SQL permissions?

A. Full administrative access

B. Principle of Least Privilege

C. Maximum compatibility

D. Public access

Correct Answer: B

Explanation:
AI-generated code should grant only the permissions necessary to perform the required task. Avoid overly broad permissions such as CONTROL or db_owner unless absolutely required.


Question 3

An AI assistant generates a stored procedure that concatenates user input into a SQL statement. What should the developer do?

A. Deploy it because AI generated it

B. Ignore it

C. Replace it with parameterized SQL

D. Disable indexing

Correct Answer: C

Explanation:
Dynamic SQL created through string concatenation is vulnerable to SQL injection. Use parameterized queries or sp_executesql to safely pass user input.


Question 4

A company must comply with GDPR. Which prompt represents the safest practice?

A. Replace customer information with anonymized sample data

B. Include production payment records

C. Upload an entire production database backup

D. Include customer names and addresses

Correct Answer: A

Explanation:
Personally identifiable information should be removed or anonymized before using AI-assisted development tools to reduce compliance and privacy risks.


Question 5

Why should developers review AI-generated SQL before deploying it?

A. AI-generated code is always optimized

B. AI may generate incorrect or insecure code

C. AI always follows organizational standards

D. AI automatically performs penetration testing

Correct Answer: B

Explanation:
AI-generated code can contain logical errors, security vulnerabilities, deprecated syntax, or poor performance choices. Human review remains essential.


Question 6

Which item is generally appropriate to include in an AI prompt?

A. Encryption keys

B. Customer Social Security numbers

C. Generic sample schema with fictional table names

D. Production API tokens

Correct Answer: C

Explanation:
Generic schemas without confidential business information allow AI to provide useful assistance while protecting sensitive organizational data.


Question 7

Which activity remains part of the Secure Development Lifecycle even when AI generates most of the SQL code?

A. Eliminating peer review

B. Skipping security testing

C. Removing code reviews

D. Performing security validation and testing

Correct Answer: D

Explanation:
AI accelerates development but does not replace testing, peer reviews, static analysis, or security validation.


Question 8

What is the primary purpose of organizational AI governance policies?

A. Increase CPU utilization

B. Define approved and secure use of AI tools

C. Eliminate documentation

D. Replace database administrators

Correct Answer: B

Explanation:
Governance policies establish which AI tools are approved, what data may be shared, required review processes, auditing requirements, and compliance expectations.


Question 9

An AI assistant recommends granting CONTROL permissions to simplify application development. What should the developer do first?

A. Apply the recommendation immediately

B. Replace CONTROL with db_owner

C. Review whether a lower permission satisfies the requirement

D. Disable authentication

Correct Answer: C

Explanation:
Broad permissions should be carefully reviewed. Following the Principle of Least Privilege helps reduce security risks by granting only the minimum required permissions.


Question 10

Which statement best describes responsible use of AI-assisted database development?

A. AI-generated code is production-ready without review.

B. AI eliminates the need for security testing.

C. AI guarantees compliance with regulations.

D. AI improves productivity, but developers remain responsible for validating security, correctness, and compliance.

Correct Answer: D

Explanation:
AI is a productivity tool, not an autonomous developer. Developers remain accountable for verifying code quality, security, regulatory compliance, and organizational standards before deployment.


Go to the DP-800 Exam Prep Hub main page

Implement error handling (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Write advanced T-SQL code
      --> Implement error handling


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Robust database applications must be able to detect, handle, and recover from errors gracefully. Whether a stored procedure is inserting data, updating records, processing transactions, or calling external services, unexpected conditions such as constraint violations, deadlocks, conversion failures, or missing objects can occur. Proper error handling prevents data corruption, improves application reliability, and provides meaningful feedback to developers and users.

SQL Server provides several built-in mechanisms for implementing error handling, including:

  • TRY...CATCH
  • THROW
  • RAISERROR (legacy)
  • Error information functions
  • Transaction control (BEGIN TRANSACTION, COMMIT, ROLLBACK)
  • XACT_STATE()
  • SET XACT_ABORT

For the DP-800: Developing AI-Enabled Database Solutions exam, you should understand how to implement structured error handling, manage transactions during errors, retrieve error details, and determine when to use THROW versus RAISERROR.


Why Error Handling Matters

Without proper error handling:

  • Transactions may remain partially completed.
  • Data consistency may be compromised.
  • Applications may receive unhelpful error messages.
  • Resources may remain locked.
  • Troubleshooting becomes difficult.

Good error handling:

  • Preserves data integrity.
  • Simplifies debugging.
  • Improves user experience.
  • Supports logging and auditing.
  • Enables reliable transaction management.

Common Types of SQL Errors

Examples include:

  • Divide-by-zero errors
  • Constraint violations
  • Duplicate key violations
  • Invalid object names
  • Data conversion failures
  • Deadlocks
  • Arithmetic overflow
  • Permission errors
  • Transaction failures
  • Lock timeouts

Example:

SELECT 100 / 0;

Produces:

Divide by zero error encountered.

TRY…CATCH

The primary error handling construct in SQL Server is the TRY...CATCH block.

General syntax:

BEGIN TRY
-- T-SQL statements
END TRY
BEGIN CATCH
-- Error handling
END CATCH;

If an error occurs inside the TRY block, execution immediately transfers to the CATCH block.


Simple TRY…CATCH Example

BEGIN TRY
SELECT 100 / 0;
END TRY
BEGIN CATCH
PRINT 'An error occurred.';
END CATCH;

Output:

An error occurred.

Handling Insert Errors

Example:

BEGIN TRY
INSERT INTO Customers(CustomerID)
VALUES (1);
END TRY
BEGIN CATCH
PRINT 'Insert failed.';
END CATCH;

If a duplicate key exists, execution moves to the CATCH block.


Retrieving Error Information

Within a CATCH block, SQL Server provides several built-in functions.

FunctionDescription
ERROR_NUMBER()Returns the error number
ERROR_MESSAGE()Returns the error text
ERROR_SEVERITY()Returns severity level
ERROR_STATE()Returns error state
ERROR_LINE()Returns line number
ERROR_PROCEDURE()Returns stored procedure name

Example:

BEGIN TRY
SELECT 100 / 0;
END TRY
BEGIN CATCH
SELECT
ERROR_NUMBER() AS ErrorNumber,
ERROR_MESSAGE() AS ErrorMessage,
ERROR_LINE() AS ErrorLine;
END CATCH;

ERROR_MESSAGE()

This function returns the descriptive text of the error.

Example:

SELECT ERROR_MESSAGE();

Possible output:

Divide by zero error encountered.

ERROR_NUMBER()

Returns SQL Server’s internal error number.

Example:

8134

Error numbers help identify specific issues and are useful for logging and troubleshooting.


ERROR_LINE()

Returns the line where the error occurred.

Example:

15

This simplifies debugging of large stored procedures.


ERROR_PROCEDURE()

Returns the stored procedure that generated the error.

Example:

usp_ProcessOrder

Returns NULL if the error occurred outside a stored procedure.


THROW

THROW is the modern method for raising exceptions.

Syntax:

THROW;

Or:

THROW
50001,
'Customer not found.',
1;

Parameters:

  • Error number (50000 or greater for user-defined errors)
  • Error message
  • State

Re-Throwing an Error

Inside a CATCH block:

BEGIN TRY
SELECT 100 / 0;
END TRY
BEGIN CATCH
THROW;
END CATCH;

This preserves the original error information, including the error number, message, severity, state, and line number.


THROW vs RAISERROR

RAISERROR is the older method for generating custom errors. It remains supported for backward compatibility but Microsoft recommends using THROW for new development.

Example:

RAISERROR
(
'Invalid customer.',
16,
1
);

Equivalent modern syntax:

THROW
50001,
'Invalid customer.',
1;

Comparing THROW and RAISERROR

FeatureTHROWRAISERROR
Recommended for new developmentYesNo (legacy)
Preserves original error when rethrowingYesNo
Supports user-defined messagesYesYes
Introduced inSQL Server 2012Earlier versions
Requires predefined messageNoOptional

Exam Tip: Unless maintaining legacy code, prefer THROW over RAISERROR.


Transactions and Error Handling

Errors often occur during transactions.

Example:

BEGIN TRANSACTION;
UPDATE Accounts
SET Balance = Balance - 100
WHERE AccountID = 1;
UPDATE Accounts
SET Balance = Balance + 100
WHERE AccountID = 2;
COMMIT;

If the second update fails, the first update may already have succeeded, resulting in inconsistent data unless the transaction is rolled back.


TRY…CATCH with Transactions

BEGIN TRY
BEGIN TRANSACTION;
UPDATE Accounts
SET Balance = Balance - 100
WHERE AccountID = 1;
UPDATE Accounts
SET Balance = Balance + 100
WHERE AccountID = 2;
COMMIT TRANSACTION;
END TRY
BEGIN CATCH
ROLLBACK TRANSACTION;
END CATCH;

This ensures that either all changes succeed or none are applied.


XACT_STATE()

XACT_STATE() determines whether the current transaction is usable.

Possible values:

ValueMeaning
1Active and committable
-1Active but uncommittable
0No active transaction

Example:

IF XACT_STATE() = -1
ROLLBACK TRANSACTION;

Why Use XACT_STATE()?

Some errors leave a transaction in an uncommittable state. Attempting to commit such a transaction will fail.

Example:

BEGIN CATCH
IF XACT_STATE() <> 0
ROLLBACK TRANSACTION;
END CATCH;

This approach is safer than issuing an unconditional ROLLBACK.


SET XACT_ABORT

SET XACT_ABORT ON automatically rolls back the current transaction when most run-time errors occur.

Example:

SET XACT_ABORT ON;
BEGIN TRANSACTION;
-- Statements
COMMIT;

Benefits:

  • Simplifies transaction management.
  • Helps avoid partially committed transactions.
  • Particularly useful in batch processing.

Logging Errors

A common practice is to log errors to an audit table.

Example:

BEGIN CATCH
INSERT INTO ErrorLog
(
ErrorNumber,
ErrorMessage,
ErrorDate
)
VALUES
(
ERROR_NUMBER(),
ERROR_MESSAGE(),
GETDATE()
);
END CATCH;

Benefits include:

  • Simplified troubleshooting.
  • Historical analysis.
  • Compliance and auditing.

Nested TRY…CATCH Blocks

Complex procedures may use nested error handling.

Example:

BEGIN TRY
BEGIN TRY
-- Inner logic
END TRY
BEGIN CATCH
THROW;
END CATCH;
END TRY
BEGIN CATCH
-- Outer handling
END CATCH;

Nested blocks allow localized handling while still propagating errors to higher-level logic.


Errors That Cannot Be Caught

Not every SQL Server error is trapped by TRY...CATCH.

Examples include:

  • Compile-time syntax errors.
  • Certain object resolution errors that occur before execution.
  • Severe errors (severity 20 or higher) that terminate the connection.
  • Client-side interruptions.

Error Handling Best Practices

  • Use TRY...CATCH in stored procedures.
  • Prefer THROW over RAISERROR for new development.
  • Roll back failed transactions.
  • Check XACT_STATE() before committing or rolling back.
  • Log important errors.
  • Return meaningful messages to calling applications.
  • Keep transactions as short as possible.
  • Avoid swallowing errors without logging or rethrowing them.
  • Use SET XACT_ABORT ON when appropriate for transactional workloads.
  • Test error-handling paths, not just successful execution paths.

Common Exam Tips

For the DP-800 exam, remember the following:

  • TRY...CATCH is SQL Server’s primary structured error-handling mechanism.
  • THROW is the preferred method for raising or rethrowing exceptions.
  • RAISERROR is a legacy feature retained for backward compatibility.
  • ERROR_NUMBER(), ERROR_MESSAGE(), ERROR_LINE(), ERROR_PROCEDURE(), ERROR_SEVERITY(), and ERROR_STATE() provide detailed error information within a CATCH block.
  • Always manage transactions carefully when errors occur.
  • Use XACT_STATE() to determine the status of the current transaction.
  • SET XACT_ABORT ON automatically rolls back most failed transactions.
  • Logging errors improves troubleshooting and operational support.

10 Practice Exam Questions

Question 1

Which T-SQL construct provides structured exception handling?

A. CASE...WHEN

B. TRY...CATCH

C. IF...ELSE

D. WHILE

Answer: B

Explanation: TRY...CATCH is the primary mechanism for structured error handling in SQL Server. Statements in the TRY block execute normally, and any run-time error transfers control to the CATCH block.


Question 2

Which function returns the text description of the error that occurred?

A. ERROR_NUMBER()

B. ERROR_MESSAGE()

C. ERROR_STATE()

D. ERROR_LINE()

Answer: B

Explanation: ERROR_MESSAGE() returns the complete descriptive text associated with the error, making it useful for logging and displaying meaningful messages.


Question 3

Which statement is recommended for raising new user-defined errors in modern SQL Server development?

A. THROW

B. PRINT

C. RETURN

D. GOTO

Answer: A

Explanation: Microsoft recommends using THROW instead of RAISERROR for new development because it provides cleaner syntax and better preserves original error information.


Question 4

What is the purpose of XACT_STATE()?

A. It determines whether indexes are fragmented.

B. It checks whether a transaction is active and whether it can still be committed.

C. It displays the current isolation level.

D. It returns the current database compatibility level.

Answer: B

Explanation: XACT_STATE() returns 1, 0, or -1 to indicate whether a transaction is committable, absent, or uncommittable, respectively.


Question 5

Which value returned by XACT_STATE() indicates an uncommittable transaction?

A. 0

B. 1

C. 100

D. -1

Answer: D

Explanation: A value of -1 indicates that the transaction is active but cannot be committed and must be rolled back.


Question 6

Which function returns the line number where an error occurred?

A. ERROR_PROCEDURE()

B. ERROR_STATE()

C. ERROR_LINE()

D. ERROR_SEVERITY()

Answer: C

Explanation: ERROR_LINE() identifies the line number where the run-time error occurred, making it easier to locate and correct issues.


Question 7

What is the primary benefit of using SET XACT_ABORT ON?

A. It automatically creates savepoints.

B. It automatically commits every transaction.

C. It disables constraint checking.

D. It automatically rolls back most transactions when a run-time error occurs.

Answer: D

Explanation: SET XACT_ABORT ON helps ensure transactional consistency by automatically rolling back the current transaction when most run-time errors occur.


Question 8

Which error information function returns the name of the stored procedure that generated the error?

A. ERROR_PROCEDURE()

B. ERROR_LINE()

C. ERROR_MESSAGE()

D. ERROR_NUMBER()

Answer: A

Explanation: ERROR_PROCEDURE() returns the name of the stored procedure where the error originated, or NULL if the error occurred outside a stored procedure.


Question 9

Which statement about THROW and RAISERROR is correct?

A. RAISERROR is required for all user-defined errors.

B. THROW cannot be used inside a CATCH block.

C. THROW is the recommended approach for new SQL Server applications.

D. THROW does not support custom error messages.

Answer: C

Explanation: THROW is the preferred method for generating and rethrowing exceptions in modern SQL Server development, while RAISERROR is maintained primarily for backward compatibility.


Question 10

Why should transactions typically be rolled back when an error occurs during a multi-step operation?

A. To improve index performance.

B. To reduce memory usage.

C. To prevent SQL Server from generating error messages.

D. To maintain data consistency by ensuring that either all operations succeed or none are applied.

Answer: D

Explanation: Rolling back a failed transaction preserves database consistency by preventing partial updates that could leave related data in an invalid or inconsistent state.


Go to the DP-800 Exam Prep Hub main page

Write correlated queries (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Write advanced T-SQL code
      --> Write correlated queries


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Correlated queries are among the most important advanced T-SQL concepts tested on the DP-800: Developing AI-Enabled Database Solutions certification exam. They allow a query to compare data from one row with data from another table or from the same table by referencing values from the outer query. Correlated queries are commonly used for row-by-row comparisons, filtering, existence checks, aggregate comparisons, and complex business logic.

Unlike standard subqueries, correlated queries are dependent on the outer query and are evaluated repeatedly—once for each row processed by the outer query. Although they can be more computationally expensive than non-correlated queries, they provide elegant solutions to many complex querying problems.

For the DP-800 exam, you should understand how correlated queries work, when to use them, how to optimize them, and how they compare to joins and window functions.


What Is a Correlated Query?

A correlated query (also called a correlated subquery) is a subquery that references one or more columns from the outer query.

Because of this dependency, the subquery cannot execute independently.

General syntax:

SELECT columns
FROM TableA A
WHERE expression
(
SELECT ...
FROM TableB B
WHERE B.Column = A.Column
);

The subquery references A.Column, which belongs to the outer query.


How Correlated Queries Work

Execution occurs in this order:

  1. SQL Server reads one row from the outer query.
  2. The correlated subquery executes using values from that row.
  3. SQL Server evaluates the result.
  4. The process repeats for every row returned by the outer query.

Unlike regular subqueries, correlated queries are evaluated multiple times.


Correlated Query Example

Suppose two tables exist:

Customers

CustomerIDCustomerName
1Alice
2Bob
3Charlie

Orders

OrderIDCustomerIDTotalAmount
1011500
1021800
1032250

Retrieve customers who have placed at least one order.

SELECT CustomerName
FROM Customers C
WHERE EXISTS
(
SELECT 1
FROM Orders O
WHERE O.CustomerID = C.CustomerID
);

The subquery references C.CustomerID, making it a correlated query.

Result:

CustomerName
Alice
Bob

Charlie is excluded because no matching order exists.


Comparing Correlated and Non-Correlated Queries

Non-Correlated Query

Runs once.

SELECT *
FROM Products
WHERE CategoryID IN
(
SELECT CategoryID
FROM Categories
);

The subquery is independent.


Correlated Query

Runs once for every outer row.

SELECT *
FROM Products P
WHERE EXISTS
(
SELECT *
FROM Inventory I
WHERE I.ProductID=P.ProductID
);

The subquery depends on P.ProductID.


EXISTS with Correlated Queries

EXISTS is one of the most common operators used with correlated queries.

It returns TRUE when the subquery finds at least one row.

Example:

SELECT CustomerName
FROM Customers C
WHERE EXISTS
(
SELECT *
FROM Orders O
WHERE O.CustomerID=C.CustomerID
);

Benefits:

  • Stops after finding the first matching row.
  • Often performs better than IN for large datasets.
  • Excellent for existence checks.

NOT EXISTS

Returns rows where no matching records exist.

Example:

SELECT CustomerName
FROM Customers C
WHERE NOT EXISTS
(
SELECT *
FROM Orders O
WHERE O.CustomerID=C.CustomerID
);

Result:

Customers without orders.


Correlated Aggregate Query

Correlated queries frequently use aggregate functions.

Example:

Return employees earning above their department average.

SELECT EmployeeName,
Salary
FROM Employees E
WHERE Salary >
(
SELECT AVG(Salary)
FROM Employees
WHERE DepartmentID=E.DepartmentID
);

For every employee, SQL Server calculates the average salary within that employee’s department.


Correlated MAX Example

Find employees with the highest salary in each department.

SELECT EmployeeName,
Salary
FROM Employees E
WHERE Salary =
(
SELECT MAX(Salary)
FROM Employees
WHERE DepartmentID=E.DepartmentID
);

Correlated MIN Example

Find products with the lowest price within each category.

SELECT ProductName,
Price
FROM Products P
WHERE Price =
(
SELECT MIN(Price)
FROM Products
WHERE CategoryID=P.CategoryID
);

Correlated COUNT Example

Return customers who placed more than three orders.

SELECT CustomerName
FROM Customers C
WHERE
(
SELECT COUNT(*)
FROM Orders O
WHERE O.CustomerID=C.CustomerID
) > 3;

Correlated SUM Example

Find salespeople whose total sales exceed $100,000.

SELECT SalesPersonName
FROM SalesPeople S
WHERE
(
SELECT SUM(TotalAmount)
FROM Orders O
WHERE O.SalesPersonID=S.SalesPersonID
) > 100000;

Correlated UPDATE

Correlated queries are not limited to SELECT statements.

Example:

UPDATE Products
SET AveragePrice =
(
SELECT AVG(UnitPrice)
FROM Sales
WHERE Sales.ProductID=Products.ProductID
);

Each product receives its own calculated average.


Correlated DELETE

Example:

Delete customers with no orders.

DELETE
FROM Customers
WHERE NOT EXISTS
(
SELECT *
FROM Orders
WHERE Orders.CustomerID=Customers.CustomerID
);

Correlated INSERT

Correlated logic can also appear during INSERT operations.

Example:

INSERT INTO VIPCustomers
SELECT *
FROM Customers C
WHERE
(
SELECT SUM(TotalAmount)
FROM Orders O
WHERE O.CustomerID=C.CustomerID
) > 50000;

Using EXISTS vs IN

Both operators may return similar results.

EXISTS

  • Stops after first match.
  • Efficient on large datasets.
  • Ideal for correlated queries.

Example:

WHERE EXISTS
(
SELECT *
FROM Orders O
WHERE O.CustomerID=C.CustomerID
)

IN

Works well for smaller lookup lists.

Example:

WHERE CustomerID IN
(
SELECT CustomerID
FROM Orders
)

Correlated Queries vs Joins

Many correlated queries can be rewritten as joins.

Correlated query:

SELECT CustomerName
FROM Customers C
WHERE EXISTS
(
SELECT *
FROM Orders O
WHERE O.CustomerID=C.CustomerID
);

Equivalent join:

SELECT DISTINCT
C.CustomerName
FROM Customers C
INNER JOIN Orders O
ON C.CustomerID=O.CustomerID;

Both produce similar results, but performance depends on indexes, data volume, and execution plans.


Correlated Queries vs Window Functions

Sometimes a window function is a better solution.

Correlated query:

SELECT EmployeeName
FROM Employees E
WHERE Salary >
(
SELECT AVG(Salary)
FROM Employees
WHERE DepartmentID=E.DepartmentID
);

Window function:

SELECT EmployeeName,
Salary
FROM
(
SELECT *,
AVG(Salary)
OVER(PARTITION BY DepartmentID) AS AvgSalary
FROM Employees
) E
WHERE Salary > AvgSalary;

Window functions often perform better because the aggregate is calculated once per partition instead of once per row.


Performance Considerations

Correlated queries can become expensive because the inner query executes repeatedly.

Performance depends on:

  • Number of rows
  • Index availability
  • Query complexity
  • Join selectivity
  • Execution plan

SQL Server’s optimizer may transform some correlated queries into more efficient execution plans automatically.


Optimizing Correlated Queries

Best practices include:

  • Create indexes on correlated columns.
  • Use EXISTS instead of COUNT(*) > 0 when checking for existence.
  • Avoid unnecessary correlated calculations.
  • Review execution plans for repeated scans.
  • Replace correlated aggregates with window functions when appropriate.
  • Rewrite some queries as joins if performance improves.
  • Filter outer rows before executing the correlated subquery.
  • Avoid scalar user-defined functions inside correlated subqueries.

Common Business Scenarios

Correlated queries are commonly used for:

  • Customers with orders
  • Employees earning above department averages
  • Highest-priced products in each category
  • Duplicate detection
  • Missing related records
  • Parent-child relationships
  • Inventory validation
  • Sales performance analysis
  • Financial reporting
  • Data quality checks

Common Exam Tips

For the DP-800 exam, remember the following:

  • A correlated query references columns from the outer query.
  • The correlated subquery executes once for each outer row.
  • EXISTS and NOT EXISTS are common correlated query operators.
  • Correlated queries are frequently used with aggregate functions such as AVG, SUM, COUNT, MIN, and MAX.
  • Correlated queries can appear in SELECT, UPDATE, DELETE, and INSERT statements.
  • Some correlated queries can be rewritten as joins or window functions for better performance.
  • Proper indexing significantly improves correlated query performance.

10 Practice Exam Questions

Question 1

What distinguishes a correlated subquery from a regular subquery?

A. It always returns multiple rows.

B. It references one or more columns from the outer query.

C. It can only be used with the EXISTS operator.

D. It cannot contain aggregate functions.

Answer: B

Explanation: A correlated subquery depends on values from the outer query by referencing its columns, causing it to execute in the context of each outer row.


Question 2

Which operator is most commonly used to determine whether related rows exist in a correlated query?

A. LIKE

B. BETWEEN

C. EXISTS

D. UNION

Answer: C

Explanation: EXISTS evaluates to TRUE when the correlated subquery returns at least one row and is optimized for existence checks.


Question 3

How many times is a correlated subquery typically evaluated?

A. Once for the entire query.

B. Once per database.

C. Once per table.

D. Once for each row processed by the outer query.

Answer: D

Explanation: Because the subquery references values from the current outer row, it is evaluated repeatedly as each outer row is processed.


Question 4

Which correlated query returns customers who have never placed an order?

A.

SELECT *
FROM Customers C
WHERE EXISTS
(
SELECT *
FROM Orders O
WHERE O.CustomerID=C.CustomerID
);

B.

SELECT *
FROM Customers
WHERE CustomerID IN
(
SELECT CustomerID
FROM Orders
);

C.

SELECT *
FROM Customers C
WHERE NOT EXISTS
(
SELECT *
FROM Orders O
WHERE O.CustomerID=C.CustomerID
);

D.

SELECT *
FROM Customers
ORDER BY CustomerID;

Answer: C

Explanation: NOT EXISTS returns rows from the outer query for which the correlated subquery finds no matching records.


Question 5

Which aggregate function is commonly used in a correlated query to find employees earning more than the average salary in their department?

A. MAX()

B. MIN()

C. COUNT()

D. AVG()

Answer: D

Explanation: AVG() calculates the departmental average salary, allowing comparison against each employee’s salary.


Question 6

Which statement about correlated queries is true?

A. They cannot be used in UPDATE statements.

B. They cannot contain aggregate functions.

C. They can be used in SELECT, UPDATE, DELETE, and INSERT statements.

D. They always perform better than joins.

Answer: C

Explanation: Correlated subqueries are supported in multiple DML statements and are often used to calculate or validate row-specific values.


Question 7

When checking whether matching rows exist, why is EXISTS often preferred over COUNT(*) > 0?

A. EXISTS automatically creates indexes.

B. EXISTS stops searching after finding the first matching row.

C. EXISTS sorts the results automatically.

D. EXISTS returns all matching rows.

Answer: B

Explanation: EXISTS can stop processing as soon as a qualifying row is found, reducing unnecessary work.


Question 8

Which feature can often replace correlated aggregate queries while improving performance?

A. Temporary tables

B. Triggers

C. Foreign keys

D. Window functions

Answer: D

Explanation: Window functions calculate aggregates across partitions in a single pass, often making them more efficient than repeatedly executing correlated aggregate subqueries.


Question 9

Which factor most directly improves the performance of correlated queries?

A. Increasing the database compatibility level

B. Creating indexes on the correlated columns

C. Using larger transaction log files

D. Increasing the database recovery model

Answer: B

Explanation: Indexes on the columns used to correlate the outer and inner queries allow SQL Server to locate matching rows much more efficiently.


Question 10

Which business scenario is a good use case for a correlated query?

A. Displaying all rows from a single table without filtering

B. Sorting products alphabetically

C. Finding the highest-paid employee within each department

D. Creating a new database

Answer: C

Explanation: Correlated queries are well suited for row-by-row comparisons against aggregates or related data, such as identifying the highest-paid employee in each department.


Go to the DP-800 Exam Prep Hub main page

Write graph queries that use the MATCH operator (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Write advanced T-SQL code
      --> Write graph queries that use the MATCH operator


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Many business problems involve relationships between entities rather than simple rows and columns. Examples include social networks, organizational hierarchies, fraud detection, recommendation engines, transportation networks, supply chains, and knowledge graphs. While relational databases excel at storing structured data, querying complex relationships often requires multiple self-joins that become increasingly difficult to write and maintain.

To address these scenarios, SQL Server and Azure SQL Database support graph databases through node tables, edge tables, and the MATCH operator. These capabilities allow developers to model and query relationships using graph patterns while continuing to leverage the relational database engine.

For the DP-800: Developing AI-Enabled Database Solutions certification exam, you should understand how to create graph objects and write graph queries using the MATCH operator.


What Is a Graph Database?

A graph database represents information as:

  • Nodes – entities or objects
  • Edges – relationships between entities

Instead of focusing solely on tables and foreign keys, graph databases emphasize how data is connected.

Example:

Alice ---- WorksWith ---- Bob
|
LivesIn
|
Orlando

In this example:

  • Alice, Bob, and Orlando are nodes
  • WorksWith and LivesIn are edges

Graph Database Components

SQL Server graph databases consist of two primary object types:

ObjectPurpose
Node TableStores entities
Edge TableStores relationships

Node Tables

Node tables represent entities.

Examples include:

  • Employees
  • Customers
  • Products
  • Cities
  • Departments
  • Suppliers

Example:

CREATE TABLE Person
(
PersonID INT PRIMARY KEY,
FullName NVARCHAR(100)
)
AS NODE;

The AS NODE clause creates a graph node table.


Edge Tables

Edge tables represent relationships between nodes.

Example:

CREATE TABLE WorksWith
(
SinceDate DATE
)
AS EDGE;

This table stores the relationship between two Person nodes.

SQL Server automatically maintains hidden graph metadata for node and edge tables.


Node and Edge Relationships

Suppose the following data exists:

John ---- WorksWith ---- Mary
Mary ---- WorksWith ---- Susan
John ---- Manages ---- David

Each person exists once in the node table.

Relationships exist separately in edge tables.


Why Use Graph Queries?

Traditional relational queries require joins.

Example:

Employee
Manager
Department

This often becomes:

Employee
JOIN Manager
JOIN Department
JOIN Office
JOIN Region

Graph queries simplify relationship traversal.


The MATCH Operator

The MATCH operator is the primary mechanism for querying graph relationships.

Instead of writing multiple joins, developers specify graph patterns.

General syntax:

SELECT ...
FROM ...
WHERE MATCH(pattern);

The pattern describes how nodes are connected.


Basic MATCH Query

Suppose the database contains:

Persons

  • John
  • Mary
  • Susan

Relationship

John → WorksWith → Mary

Query:

SELECT
p1.FullName,
p2.FullName
FROM Person p1,
WorksWith w,
Person p2
WHERE MATCH
(
p1-(w)->p2
);

Result:

FullNameFullName
JohnMary

Understanding Graph Pattern Syntax

Example:

p1-(w)->p2

Meaning:

  • Start with node p1
  • Traverse edge w
  • Reach node p2

Arrow direction matters.


Reverse Direction

Example:

p1<-(w)-p2

Meaning:

p2 → p1

The relationship is traversed in the opposite direction.


Multiple Relationships

Suppose:

John → Mary
Mary → Susan

Query:

WHERE MATCH
(
John-(WorksWith)->Mary-(WorksWith)->Susan
);

The MATCH operator follows multiple hops.


Multi-Hop Queries

Graph databases excel at traversing multiple relationships.

Example:

Find employees connected through two working relationships.

Employee
WorksWith
Employee
WorksWith
Employee

Without graphs this may require several joins.

With MATCH the relationship path is much easier to express.


Multiple Edge Types

Suppose the graph contains:

John
WorksWith
Mary
LivesIn
Seattle

Query:

John-(WorksWith)->Mary-(LivesIn)->Seattle

The MATCH operator supports multiple relationship types within a single query.


Using MATCH with SELECT

Example:

SELECT
p.FullName,
c.CityName
FROM Person p,
LivesIn l,
City c
WHERE MATCH
(
p-(l)->c
);

Result

PersonCity
JohnSeattle
MaryOrlando

Combining MATCH with WHERE

Additional filtering can be applied.

Example:

SELECT
p.FullName
FROM Person p,
WorksWith w,
Person p2
WHERE MATCH
(
p-(w)->p2
)
AND p2.Department='Sales';

Graph traversal occurs first.

The remaining rows are filtered normally.


MATCH and JOINs

Graph queries can still use relational joins.

Example:

SELECT
p.FullName,
d.DepartmentName
FROM Person p,
WorksWith w,
Person p2
JOIN Department d
ON p2.DepartmentID=d.DepartmentID
WHERE MATCH
(
p-(w)->p2
);

Graph features integrate with standard SQL.


Graph Queries for AI Applications

Graph databases are becoming increasingly valuable for AI applications because they naturally represent relationships between people, documents, products, concepts, and events.

Examples include:

  • Knowledge graphs
  • Recommendation systems
  • Fraud detection
  • Supply chain analysis
  • Social networks
  • Customer relationship analysis
  • Semantic search
  • Retrieval-Augmented Generation (RAG)
  • Entity linking
  • Relationship discovery

Large Language Models (LLMs) often benefit from graph data because relationships provide richer context than isolated rows.


Knowledge Graph Example

Suppose an AI application stores:

Customer
Purchased
Product
ManufacturedBy
Company

The MATCH operator can quickly discover:

  • Which products customers purchased
  • Which companies manufacture them
  • Similar purchasing relationships
  • Connected entities

Fraud Detection

Graph databases are excellent for identifying suspicious relationships.

Example:

Customer
Owns
Account
TransfersMoneyTo
Account
OwnedBy
Customer

MATCH queries can identify complex money-transfer networks that would require many joins in a traditional relational model.


Recommendation Engines

Streaming services often recommend content based on relationships.

Example:

User
Likes
Movie
DirectedBy
Director

Graph queries efficiently discover similar users and related content.


Relationship Discovery

Graph databases make it easy to answer questions such as:

  • Who works with whom?
  • Which customers purchased similar products?
  • Which suppliers serve the same regions?
  • Which employees report to the same manager?
  • Which products share common components?

These scenarios are ideal for MATCH queries.


Performance Considerations

Graph queries can outperform complex self-joins when relationship traversal is the primary objective.

Best practices include:

  • Keep node and edge tables appropriately indexed.
  • Filter data before traversing large graphs when possible.
  • Avoid unnecessary relationship hops.
  • Use graph queries only when relationships are central to the problem.
  • Continue using relational tables for highly tabular data.

Best Practices

  • Model entities as node tables.
  • Model relationships as edge tables.
  • Use descriptive edge names.
  • Keep graph models simple.
  • Combine MATCH with relational filtering when appropriate.
  • Choose graph queries only when relationship traversal is required.
  • Avoid replacing relational designs unnecessarily.
  • Document graph relationships clearly.
  • Test graph queries with realistic datasets.
  • Consider graph databases for AI-powered relationship analysis.

Common Exam Tips

For the DP-800 exam, remember the following:

  • Graph databases store entities as nodes and relationships as edges.
  • Node tables are created using AS NODE.
  • Edge tables are created using AS EDGE.
  • The MATCH operator traverses graph relationships.
  • Arrow direction (-> and <-) determines relationship direction.
  • MATCH can traverse multiple relationships in a single query.
  • Graph queries integrate with standard SQL statements.
  • Graph databases are well suited for knowledge graphs, recommendation engines, fraud detection, supply chains, and AI-enabled applications that rely on relationship analysis.

Practice Exam Questions

Question 1

Which SQL Server object stores relationships between entities in a graph database?

A. View

B. Node table

C. Edge table

D. Stored procedure

Answer: C

Explanation: Edge tables store the relationships between nodes and are created using the AS EDGE clause.


Question 2

Which clause is used when creating a graph node table?

A.

AS GRAPH

B.

AS NODE

C.

AS ENTITY

D.

AS OBJECT

Answer: B

Explanation: A graph node table is created by appending the AS NODE clause to a CREATE TABLE statement.


Question 3

What is the primary purpose of the MATCH operator?

A. Perform full-text searches

B. Compare two strings

C. Traverse graph relationships between nodes

D. Create graph indexes

Answer: C

Explanation: MATCH specifies graph traversal patterns, allowing SQL Server to navigate relationships represented by edge tables.


Question 4

In the graph pattern:

p1-(w)->p2

what does the arrow (->) indicate?

A. The relationship flows from p1 through edge w to p2.

B. The relationship flows from p2 to p1.

C. The query performs an inner join.

D. The graph contains duplicate nodes.

Answer: A

Explanation: The arrow indicates the direction of traversal from the starting node (p1) through the edge (w) to the destination node (p2).


Question 5

Which scenario is best suited for SQL Server graph queries?

A. Calculating monthly payroll totals

B. Traversing employee reporting relationships across multiple organizational levels

C. Sorting sales by date

D. Updating a single customer record

Answer: B

Explanation: Graph queries excel at traversing complex relationships, such as organizational hierarchies and reporting structures.


Question 6

Which statement about graph queries in SQL Server is true?

A. They cannot be combined with traditional SQL queries.

B. They require a separate graph database engine.

C. They can be combined with relational filtering and joins.

D. They replace foreign keys.

Answer: C

Explanation: SQL Server graph queries integrate with standard T-SQL and can be combined with joins, filters, and other relational features.


Question 7

Which of the following is represented by a node table?

A. A relationship between two customers

B. A connection between two products

C. A customer entity

D. A graph traversal path

Answer: C

Explanation: Node tables represent entities such as customers, employees, products, or cities, while edge tables represent the relationships between them.


Question 8

Why are graph databases valuable for Retrieval-Augmented Generation (RAG) and other AI solutions?

A. They automatically train language models.

B. They store only vector embeddings.

C. They eliminate the need for SQL queries.

D. They model and query rich relationships that provide additional context for AI systems.

Answer: D

Explanation: Graph databases capture connections among entities, allowing AI applications to retrieve contextual information that improves reasoning and search results.


Question 9

What is the advantage of using the MATCH operator instead of multiple self-joins?

A. It encrypts graph data automatically.

B. It simplifies expressing relationship traversal patterns.

C. It automatically creates indexes.

D. It eliminates the need for edge tables.

Answer: B

Explanation: MATCH provides a concise, intuitive syntax for traversing relationships that would otherwise require numerous joins.


Question 10

A database models employees, departments, and managers as graph nodes connected by edge tables. Which query feature should be used to find employees connected to a specific manager through defined relationships?

A. LIKE

B. GROUP BY

C. MERGE

D. MATCH

Answer: D

Explanation: The MATCH operator is specifically designed for traversing relationships in SQL Server graph databases and is the appropriate choice for this type of query.


Go to the DP-800 Exam Prep Hub main page

Write queries that include fuzzy string matching functions, such as EDIT_DISTANCE, EDIT_DISTANCE_SIMILARITY, and JARO_WINKLER_DISTANCE (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Write advanced T-SQL code
      --> Write queries that include fuzzy string matching functions, such as EDIT_DISTANCE, EDIT_DISTANCE_SIMILARITY, and JARO_WINKLER_DISTANCE


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Traditional string comparisons in SQL use operators such as = and LIKE, which require an exact or pattern-based match. However, real-world data is often inconsistent. Misspellings, abbreviations, typographical errors, and formatting differences frequently occur in customer names, product descriptions, addresses, emails, and other text fields.

To address these challenges, SQL Server 2025 (17.x) Preview and Azure SQL Database introduce native fuzzy string matching functions. These functions measure how similar two strings are rather than requiring them to match exactly.

For the DP-800: Developing AI-Enabled Database Solutions certification exam, understanding fuzzy matching is valuable because AI-enabled applications frequently work with imperfect or human-generated text. Fuzzy matching can improve search accuracy, data quality, duplicate detection, and entity matching.

The primary fuzzy matching functions include:

  • EDIT_DISTANCE()
  • EDIT_DISTANCE_SIMILARITY()
  • JARO_WINKLER_DISTANCE()

These functions allow developers to compare strings and determine how closely they resemble one another.

Exam Note: These fuzzy matching functions are new capabilities introduced in SQL Server 2025 (17.x) Preview and Azure SQL Database. They represent Microsoft’s modern approach to intelligent text processing and may appear in newer versions of the DP-800 exam.


What is Fuzzy String Matching?

Fuzzy string matching compares two strings and determines how similar they are, even if they are not identical.

For example:

String 1String 2Similar?
MicrosoftMicrosoftYes
Jon SmithJohn SmithYes
ContosoContoso LtdYes
DatabaseDatabazeYes
AzureAmazonNo

Unlike an equality comparison (=), fuzzy matching recognizes that many differences are minor typographical variations.


Why Fuzzy Matching Matters

Organizations often receive data from multiple sources:

  • Customer registration forms
  • Web applications
  • Mobile apps
  • AI chatbots
  • OCR (Optical Character Recognition)
  • Voice transcription
  • External APIs
  • CSV imports

These data sources often contain spelling mistakes or inconsistent formatting.

Examples include:

OriginalVariation
JonathanJonathon
KatherineCatherine
MicrosoftMicrosft
OrlandoOrlando
SQL ServerSQLServer

Traditional SQL comparisons fail to recognize these values as similar, whereas fuzzy matching functions can identify likely matches.


Understanding Edit Distance

The Edit Distance (also known as the Levenshtein distance) measures the minimum number of operations required to transform one string into another.

The allowed operations are:

  • Insert a character
  • Delete a character
  • Replace a character

Example:

CAT
CUT

Only one substitution is required:

A → U

Edit distance = 1

Another example:

Microsoft
Microsft

Only one missing letter (“o”).

Edit distance = 1

The lower the edit distance, the more similar the strings.


EDIT_DISTANCE()

Purpose

Returns the minimum number of character edits required to convert one string into another.

Syntax

EDIT_DISTANCE(string1, string2)

Example

SELECT EDIT_DISTANCE(
'Microsoft',
'Microsft'
);

Output

1

Example

SELECT EDIT_DISTANCE(
'Database',
'Databaze'
);

Output

1

Example

SELECT EDIT_DISTANCE(
'Azure',
'Amazon'
);

Output

5

A larger number indicates the strings are less similar.


Common Uses of EDIT_DISTANCE()

  • Duplicate customer detection
  • Name matching
  • Address matching
  • Product matching
  • AI-generated text validation
  • OCR correction
  • Search suggestions
  • Data cleansing

EDIT_DISTANCE_SIMILARITY()

Purpose

Returns a similarity score rather than the number of edits.

Instead of measuring differences, this function measures similarity.

Syntax

EDIT_DISTANCE_SIMILARITY(
string1,
string2
)

The function returns a percentage-like similarity score.

Higher values indicate greater similarity.

Example

SELECT EDIT_DISTANCE_SIMILARITY(
'Jonathan',
'Jonathon'
);

Possible output

89

Example

SELECT EDIT_DISTANCE_SIMILARITY(
'SQL Server',
'SQL Server'
);

Output

100

Example

SELECT EDIT_DISTANCE_SIMILARITY(
'Azure',
'Amazon'
);

Possible output

20

Interpreting Similarity Scores

SimilarityMeaning
100Exact match
90–99Nearly identical
75–89Likely match
50–74Possibly related
Below 50Usually unrelated

Developers commonly define thresholds depending on business requirements.

For example:

Similarity >= 90

might be considered an automatic match.


JARO_WINKLER_DISTANCE()

Purpose

Measures similarity using the Jaro-Winkler algorithm, which gives additional weight to matching prefixes.

This algorithm performs particularly well for:

  • Person names
  • Company names
  • City names
  • Street names

Because many spelling variations occur toward the end of words, Jaro-Winkler favors strings that begin similarly.

Example

John
Jon

Very high similarity.

Example

Jonathan
Jonathon

High similarity.

Example

Smith
Smyth

High similarity.


Syntax

JARO_WINKLER_DISTANCE(
string1,
string2
)

Example

SELECT JARO_WINKLER_DISTANCE(
'Jonathan',
'Jonathon'
);

Possible output

0.08

Lower values indicate the strings are more alike (with 0 representing an exact match).


Edit Distance vs. Jaro-Winkler

FeatureEDIT_DISTANCEJARO_WINKLER_DISTANCE
MeasuresCharacter editsOverall similarity
Best forGeneral textNames
Handles typosExcellentExcellent
Considers prefixesNoYes
Duplicate detectionYesYes
Name matchingGoodExcellent

Real-World Business Scenarios

Customer Deduplication

John Smith
Jon Smith

Likely the same customer.


Product Matching

Surface Laptop
Surface Laptp

Typographical error.


Address Matching

123 Main Street
123 Main St.

Likely identical location.


OCR Cleanup

OCR software may read:

Micr0soft

instead of

Microsoft

Fuzzy matching helps identify the intended value.


AI Output Validation

Large language models occasionally generate slight variations:

SQL Sever

instead of

SQL Server

Fuzzy matching can detect likely errors before data is stored.


AI-Enabled Database Scenarios

These functions are especially useful in AI-powered database solutions.

Examples include:

  • Matching chatbot responses to known products
  • Detecting duplicate support tickets
  • Matching customer names across systems
  • Validating OCR-generated text
  • Comparing AI-generated summaries
  • Detecting near-duplicate documents
  • Matching vector-search metadata
  • Intelligent search suggestions
  • Auto-correcting user input
  • Identity resolution

Performance Considerations

Fuzzy matching functions perform more computation than exact string comparisons.

Best practices include:

  • Filter data before applying fuzzy matching.
  • Use indexes to reduce the number of candidate rows.
  • Avoid comparing every row to every other row.
  • Use similarity thresholds to eliminate weak matches.
  • Test performance on production-sized datasets.
  • Consider precomputing or caching similarity scores for frequently compared values.
  • Use fuzzy matching only when exact matching is insufficient.

Best Practices

  • Normalize text before comparison (trim spaces, consistent casing, remove unnecessary punctuation).
  • Use exact matching whenever possible for better performance.
  • Choose appropriate similarity thresholds for your business requirements.
  • Use EDIT_DISTANCE() when you need the number of edits.
  • Use EDIT_DISTANCE_SIMILARITY() when you need an intuitive similarity score.
  • Use JARO_WINKLER_DISTANCE() for names and identity matching.
  • Validate results before automatically merging records.
  • Benchmark fuzzy matching against realistic datasets.

Common Exam Tips

Remember these key points for the DP-800 exam:

  • Fuzzy matching compares similarity rather than exact equality.
  • EDIT_DISTANCE() returns the number of edits needed to transform one string into another.
  • Smaller edit distances indicate greater similarity.
  • EDIT_DISTANCE_SIMILARITY() returns a normalized similarity score, where higher values represent more similar strings.
  • JARO_WINKLER_DISTANCE() emphasizes matching prefixes and is particularly effective for comparing names.
  • Fuzzy matching is useful for data quality, duplicate detection, AI-generated content validation, OCR cleanup, and intelligent search.
  • Because fuzzy matching is computationally intensive, use it selectively and after narrowing the candidate set when possible.

Practice Exam Questions

Question 1

A company imports customer records from multiple systems. Which function is best suited to determine the minimum number of character changes required to transform one customer name into another?

A. EDIT_DISTANCE()

B. EDIT_DISTANCE_SIMILARITY()

C. JARO_WINKLER_DISTANCE()

D. LIKE

Answer: A

Explanation: EDIT_DISTANCE() calculates the minimum number of insertions, deletions, and substitutions needed to transform one string into another.


Question 2

Which fuzzy matching function returns a normalized similarity score where higher values indicate more similar strings?

A. REGEXP_LIKE()

B. JARO_WINKLER_DISTANCE()

C. EDIT_DISTANCE_SIMILARITY()

D. CHARINDEX()

Answer: C

Explanation: EDIT_DISTANCE_SIMILARITY() converts the edit distance into a similarity score, making it easier to establish matching thresholds.


Question 3

A database developer is comparing customer names such as “John” and “Jon.” Which function is generally most appropriate?

A. EDIT_DISTANCE()

B. PATINDEX()

C. LIKE

D. JARO_WINKLER_DISTANCE()

Answer: D

Explanation: Jaro-Winkler is particularly effective for comparing names because it gives additional weight to matching prefixes.


Question 4

What does an EDIT_DISTANCE() value of 0 indicate?

A. The strings are unrelated.

B. One string contains only numbers.

C. The strings are identical.

D. The comparison failed.

Answer: C

Explanation: An edit distance of zero means no insertions, deletions, or substitutions are required because the strings are identical.


Question 5

Which scenario is the best candidate for fuzzy string matching?

A. Comparing integer primary keys.

B. Matching customer names entered manually.

C. Sorting dates.

D. Calculating sales totals.

Answer: B

Explanation: Fuzzy matching is designed to compare imperfect text, such as names entered by users that may contain spelling variations.


Question 6

Why should fuzzy matching generally be applied after filtering candidate rows?

A. It prevents SQL injection.

B. It automatically creates indexes.

C. It reduces computational cost and improves query performance.

D. It guarantees exact matches.

Answer: C

Explanation: Fuzzy matching algorithms are more expensive than exact comparisons, so reducing the candidate set improves performance.


Question 7

Which statement about JARO_WINKLER_DISTANCE() is correct?

A. It counts the number of vowels in a string.

B. It gives additional weight to matching prefixes.

C. It replaces text using regular expressions.

D. It returns the number of character edits.

Answer: B

Explanation: The Jaro-Winkler algorithm favors strings that share the same beginning, making it particularly useful for matching names.


Question 8

Which of the following is a common AI-enabled use case for fuzzy string matching?

A. Creating clustered indexes.

B. Encrypting sensitive columns.

C. Detecting likely duplicate support tickets generated by AI systems.

D. Managing SQL Server backups.

Answer: C

Explanation: AI-generated text may contain slight wording differences, making fuzzy matching valuable for identifying duplicate or highly similar records.


Question 9

A similarity score of 100 returned by EDIT_DISTANCE_SIMILARITY() most likely indicates:

A. The strings are completely different.

B. The strings have five character differences.

C. The comparison failed.

D. The strings are identical.

Answer: D

Explanation: A score of 100 represents an exact match between the two strings.


Question 10

Which statement best describes fuzzy string matching?

A. It requires strings to be identical.

B. It compares the similarity between strings, even when they contain typographical errors.

C. It is designed exclusively for JSON processing.

D. It replaces SQL indexes.

Answer: B

Explanation: Fuzzy matching measures similarity rather than exact equality, making it useful for handling misspellings, abbreviations, and other textual variations.


Go to the DP-800 Exam Prep Hub main page