Tag: Azure SQL Database

Evaluate external models, including multimodal, multilanguage, sizes, and structured output (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Implement AI capabilities in database solutions (25–30%)
   --> Design and implement models and embeddings
      --> Evaluate external models, including multimodal, multilanguage, sizes, and structured output


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important responsibilities of a SQL AI Developer is selecting the appropriate AI model for a given business problem. Microsoft SQL Server, Azure SQL Database, Azure SQL Managed Instance, and Azure AI services increasingly integrate with external Large Language Models (LLMs) and embedding models to provide intelligent capabilities such as natural language querying, document summarization, semantic search, recommendation engines, and Retrieval-Augmented Generation (RAG).

Not every model is suitable for every workload. Larger models generally provide better reasoning but incur higher costs and latency. Smaller models offer faster responses and lower costs but may lack advanced reasoning capabilities. Some models support images and audio (multimodal), while others specialize in text or code. Additionally, many enterprise applications require structured outputs such as JSON rather than free-form text.

For the DP-800 exam, candidates should understand how to evaluate external models based on business requirements, performance, cost, scalability, and AI capabilities.


What Are External Models?

An external model is an AI model that runs outside the database engine and is accessed through an API or AI service.

Examples include:

  • Azure OpenAI models
  • Azure AI Foundry-hosted models
  • Open-source models hosted on Azure AI Foundry or Kubernetes
  • Other cloud-hosted foundation models exposed through REST APIs

Instead of performing AI inference inside SQL Server, the application or database calls an external service.

Example architecture:

Application
│
▼
Azure SQL Database
│
▼
Azure OpenAI Service
│
▼
AI Model
│
▼
Generated Response

This approach allows SQL-based applications to leverage continuously improving AI models without modifying the database engine.


Factors When Evaluating External Models

Several characteristics should be considered before selecting a model.

These include:

  • Accuracy
  • Reasoning capability
  • Response quality
  • Cost
  • Latency
  • Throughput
  • Context window size
  • Structured output support
  • Multilingual capability
  • Multimodal capability
  • Security and compliance
  • Availability
  • Scalability

Selecting the right model is often a balance between these factors rather than maximizing any single characteristic.


Evaluating Multimodal Models

What Is a Multimodal Model?

A multimodal model can process multiple types of input rather than only text.

Common input types include:

  • Text
  • Images
  • Documents
  • Charts
  • Audio
  • Video (supported by some models)

Example:

A customer uploads:

  • Invoice PDF
  • Photograph of damaged goods
  • Written description

A multimodal model can analyze all three inputs together.


Business Scenarios

Multimodal models are useful for:

  • Document analysis
  • Invoice processing
  • Insurance claims
  • Medical imaging
  • Manufacturing quality inspections
  • Product recognition
  • OCR-enhanced workflows
  • Diagram interpretation

Example:

Instead of asking:

“Describe this invoice.”

The application uploads the invoice itself.

The model extracts:

  • Vendor
  • Invoice number
  • Total
  • Purchase date
  • Line items

Advantages

Multimodal models:

  • Reduce preprocessing
  • Improve accuracy
  • Handle real-world data
  • Simplify AI workflows
  • Support richer user experiences

Limitations

They typically:

  • Cost more
  • Require more compute resources
  • Have higher latency
  • Process larger payloads
  • May not be necessary for text-only applications

Evaluating Multilingual Models

Many enterprise applications serve users around the world.

A multilingual model understands and generates responses in multiple languages without requiring translation.

Example languages include:

  • English
  • Spanish
  • French
  • German
  • Portuguese
  • Japanese
  • Chinese
  • Korean
  • Arabic

Example

Customer question:

Spanish:

¿Cuál es el estado de mi pedido?

The AI responds correctly in Spanish.


Business Benefits

Multilingual models:

  • Improve customer experience
  • Eliminate translation pipelines
  • Simplify global deployments
  • Maintain conversational context across languages
  • Reduce development complexity

Evaluation Criteria

When comparing multilingual models, evaluate:

  • Number of supported languages
  • Translation quality
  • Cultural understanding
  • Domain-specific terminology
  • Consistency across languages
  • Response quality

Common Use Cases

  • Global customer support
  • International e-commerce
  • Government services
  • Travel applications
  • Healthcare portals
  • Financial institutions

Evaluating Model Size

Model size generally refers to the relative complexity and capability of an AI model. While parameter counts are not always publicly disclosed for commercial models, larger models typically provide stronger reasoning at the cost of increased compute requirements.

Generally:

Small model

  • Faster
  • Lower cost
  • Lower latency

Large model

  • Better reasoning
  • Better code generation
  • Better summarization
  • Higher cost
  • Higher latency

Small Models

Ideal for:

  • Chatbots
  • Classification
  • Data extraction
  • Intent detection
  • Basic summarization

Advantages:

  • Fast responses
  • Low operational cost
  • High throughput
  • Efficient scaling

Medium Models

Good balance between:

  • Performance
  • Cost
  • Accuracy

Typical uses:

  • Customer support
  • SQL generation
  • Business assistants
  • Document summarization

Large Models

Best for:

  • Complex reasoning
  • Long documents
  • Advanced coding
  • RAG
  • Planning
  • Agentic AI

Trade-offs include:

  • Higher inference costs
  • Greater latency
  • Increased resource consumption

Latency vs. Accuracy

Every AI solution involves balancing response speed and output quality.

Example:

Customer chatbot

Acceptable latency:

2–3 seconds

Scientific research assistant

Acceptable latency:

10–20 seconds

because answer quality matters more than speed.


Trade-Off Example

RequirementPreferred Model
Fast API responsesSmaller model
High-quality reasoningLarger model
Thousands of concurrent usersSmaller or medium model
Legal document analysisLarger model
AI coding assistantLarger model
FAQ chatbotSmaller model

Context Window Size

The context window defines how much information the model can process in a single request.

A larger context window allows the model to consider more text simultaneously.

Examples include:

  • Long contracts
  • Large knowledge bases
  • Entire manuals
  • Meeting transcripts
  • Large SQL schemas

Benefits

Larger context windows reduce the need to split documents into smaller chunks and help preserve context across lengthy inputs.


Limitations

Larger contexts generally:

  • Increase processing time
  • Increase inference cost
  • Consume more tokens

Applications should include only relevant information rather than maximizing context size unnecessarily.


Structured Output

Many enterprise applications require machine-readable responses instead of conversational text.

Example:

Instead of:

“The customer’s order total is $425 and ships tomorrow.”

Return:

{
"customer":"John Smith",
"orderTotal":425,
"shipDate":"2026-07-29"
}

Structured output allows applications to parse responses reliably.


Why Structured Output Matters

Applications can:

  • Deserialize JSON
  • Populate SQL tables
  • Call stored procedures
  • Trigger workflows
  • Validate data
  • Build dashboards

without performing fragile text parsing.


Common Structured Formats

  • JSON
  • JSON arrays
  • Objects
  • Lists
  • Tables
  • XML (less common)
  • Markdown tables (for presentation)

JSON remains the most common structured format for modern AI integrations.


Function Calling and Tool Use

Many modern models support function calling (also called tool calling), where the model requests that the application invoke predefined functions or APIs instead of generating all information directly.

Example workflow:

User
│
▼
LLM
│
Calls:
GetCustomerOrders()
│
Application
│
SQL Database
│
Results
│
LLM
│
Final Answer

This approach improves accuracy by combining model reasoning with authoritative business data.


Cost Considerations

AI model selection has a direct impact on operational cost.

Factors affecting cost include:

  • Model complexity
  • Input tokens
  • Output tokens
  • Images processed
  • Audio processed
  • Request volume
  • Concurrency
  • Context window size

A higher-capability model should only be selected when its additional reasoning or multimodal features provide measurable business value.


Benchmarking Models

Before deploying an external model into production, evaluate it against representative workloads.

Typical metrics include:

  • Response accuracy
  • Hallucination rate
  • Latency
  • Cost per request
  • Throughput
  • Reliability
  • Structured output validity
  • Multilingual quality
  • Safety and policy compliance

Use realistic prompts and datasets that reflect production scenarios.


Security and Responsible AI

When integrating external models with SQL-based applications:

  • Protect sensitive data.
  • Apply the principle of least privilege.
  • Use managed identities where possible.
  • Store secrets securely (for example, in Azure Key Vault).
  • Validate AI-generated outputs before acting on them.
  • Avoid sending unnecessary personally identifiable information (PII) to external services.
  • Monitor prompts and responses for safety, quality, and compliance.

Azure OpenAI Model Selection Guidance

Although Microsoft’s available models evolve over time, the evaluation process remains consistent.

When choosing a model, consider:

  • Does the workload require multimodal input?
  • Is multilingual support necessary?
  • What response latency is acceptable?
  • How much reasoning capability is required?
  • Is structured JSON output needed?
  • Will the model participate in a RAG workflow?
  • What are the expected request volumes?
  • What is the available budget?

The best model is the one that satisfies the business requirements while meeting performance, cost, and governance objectives.


Best Practices

  • Match model capability to business requirements.
  • Avoid selecting the largest model unless its advanced capabilities are needed.
  • Use structured outputs whenever applications consume AI responses programmatically.
  • Benchmark multiple models using representative production scenarios.
  • Minimize token usage to reduce costs and improve response times.
  • Use multimodal models only when image, audio, or document understanding is required.
  • Validate generated content before updating databases or executing business processes.
  • Monitor quality, latency, and cost continuously after deployment.

DP-800 Exam Tips

Remember these key distinctions for the exam:

  • Multimodal models process multiple input types, such as text and images.
  • Multilingual models understand and generate content in multiple languages without requiring separate translation services.
  • Smaller models typically provide lower latency and lower cost, making them suitable for high-volume, straightforward tasks.
  • Larger models generally provide stronger reasoning, summarization, and code generation but require more compute resources and incur higher costs.
  • Structured outputs, particularly JSON, are preferred when AI responses must be consumed by applications, APIs, or SQL processes.
  • Function calling allows models to invoke trusted business logic or database operations instead of relying solely on generated responses.
  • Model selection should always balance accuracy, latency, scalability, cost, security, and maintainability.

Summary

Selecting an external AI model is one of the most important architectural decisions in AI-enabled database solutions. The ideal model depends on the workload, whether that involves multilingual customer support, multimodal document analysis, structured data extraction, or advanced reasoning over enterprise data.

For the DP-800 exam, focus on understanding the trade-offs among model capabilities rather than memorizing specific model names. Be prepared to evaluate models based on multimodal support, multilingual performance, reasoning quality, latency, cost, context window size, and structured output capabilities. Equally important is understanding how these models integrate with Azure SQL and Azure AI services to build scalable, secure, and maintainable AI-enabled database solutions.


Practice Exam Questions


Question 1

You are developing an AI-enabled application that summarizes support tickets stored in Azure SQL Database. The application must support English, Spanish, French, German, and Japanese without deploying separate models for each language.

Which type of model best satisfies this requirement?

A. A monolingual English language model with prompt translation
B. A multilingual language model trained on multiple languages
C. A computer vision model with OCR capabilities
D. A speech recognition model

Correct Answer: B

Explanation:
Multilingual large language models (LLMs) are specifically trained to understand and generate text in many languages, eliminating the need to deploy separate models for each supported language. While prompt translation can work, it introduces additional latency and possible translation inaccuracies. Computer vision and speech models are not designed for multilingual text generation.


Question 2

An organization wants an AI model that can analyze scanned invoices, extract tables, understand handwritten notes, and answer user questions about the document.

Which model capability is required?

A. Structured output only
B. Text embedding generation
C. Multimodal processing
D. Sentiment analysis

Correct Answer: C

Explanation:
Multimodal models process multiple input types—including images, documents, handwritten text, and natural language—allowing them to interpret invoices and answer questions. Embedding models create vector representations but do not analyze images directly.


Question 3

You need an AI model that consistently returns data in valid JSON matching a predefined schema for direct insertion into a SQL table.

Which capability should you prioritize?

A. Long context window
B. Large parameter count
C. Function calling only
D. Structured output support

Correct Answer: D

Explanation:
Structured output capabilities ensure responses conform to predefined schemas such as JSON, reducing parsing errors and simplifying database integration. Function calling invokes external operations but does not guarantee JSON schema compliance.


Question 4

Your application performs simple product categorization and sentiment analysis on thousands of customer reviews every minute. Response time and operational cost are more important than handling complex reasoning tasks.

Which model size is the most appropriate?

A. The largest available reasoning model
B. A medium-sized multimodal model
C. A small language model optimized for classification tasks
D. A vision-language model

Correct Answer: C

Explanation:
Simple classification workloads generally do not require large reasoning models. Smaller models provide lower latency, reduced infrastructure costs, and sufficient accuracy for routine categorization and sentiment analysis.


Question 5

A financial institution evaluates several external AI models before deployment.

Which factor should receive the highest priority when handling confidential customer information?

A. Number of supported programming languages
B. Data privacy and regulatory compliance
C. Maximum context window size
D. Availability of image generation

Correct Answer: B

Explanation:
For regulated industries, protecting sensitive information and complying with regulations are primary evaluation criteria. Features such as image generation or larger context windows are secondary if the model cannot satisfy organizational security and compliance requirements.


Question 6

Your organization must choose between two external language models.

Model A produces slightly more accurate answers but averages 8 seconds per response.

Model B is slightly less accurate but consistently responds in under one second.

Which consideration is being evaluated?

A. Tokenization strategy
B. Embedding dimensions
C. Latency versus accuracy tradeoff
D. Database normalization

Correct Answer: C

Explanation:
Model evaluation frequently involves balancing response quality against latency. Interactive applications often prioritize faster responses, while analytical workloads may tolerate longer processing times for greater accuracy.


Question 7

A development team is comparing two embedding models.

One produces 768-dimensional vectors while another produces 3,072-dimensional vectors.

What is generally true?

A. Higher-dimensional embeddings always guarantee better search results.
B. Larger embeddings often improve semantic representation but require more storage and computation.
C. Embedding dimensions have no effect on vector databases.
D. Smaller embeddings always produce higher recall.

Correct Answer: B

Explanation:
Higher-dimensional vectors can capture richer semantic information but increase storage requirements, indexing costs, and similarity search computation. Larger dimensions do not automatically produce better search quality.


Question 8

A healthcare application requires AI-generated discharge summaries that follow a strict template so they can be automatically imported into Azure SQL Database.

Which model feature is most important?

A. Image generation capabilities
B. Speech synthesis support
C. Larger token limits only
D. Structured output generation

Correct Answer: D

Explanation:
Structured outputs enable AI-generated responses to consistently match required formats, such as JSON or predefined schemas, simplifying automated ingestion into databases and reducing validation errors.


Question 9

Why might an organization intentionally choose a smaller external language model instead of the newest, largest model?

A. Smaller models are always more accurate.
B. Smaller models always support more languages.
C. Smaller models often provide lower cost, reduced latency, and sufficient performance for many workloads.
D. Smaller models eliminate the need for prompt engineering.

Correct Answer: C

Explanation:
Many enterprise workloads involve straightforward tasks where the largest model offers minimal additional benefit. Smaller models frequently provide faster responses, lower inference costs, and simpler deployment while meeting performance requirements.


Question 10

An AI-enabled SQL application must process both text and uploaded product images to answer customer questions.

Which model should be recommended?

A. A multimodal language model
B. A text embedding model only
C. A relational database engine
D. A recommendation engine

Correct Answer: A

Explanation:
Multimodal models can simultaneously process textual and visual information, enabling users to ask questions about images and receive context-aware responses. Text embedding models only generate vector representations and cannot directly analyze images.


Exam Tips

For the DP-800 exam, remember these key evaluation principles when selecting external AI models:

  • Select multilingual models when supporting multiple languages without translation pipelines.
  • Choose multimodal models whenever applications must process images, documents, audio, or mixed media.
  • Prefer structured output capabilities when AI responses must populate SQL tables or APIs reliably.
  • Evaluate model size based on workload complexity, balancing cost, latency, throughput, and reasoning ability.
  • Consider privacy, compliance, and data residency before selecting external AI services.
  • Compare models using multiple metrics, including accuracy, latency, throughput, token limits, context window size, scalability, and operational cost.
  • Remember that larger models are not always the best choice—the optimal model is the one that best satisfies the application’s functional, performance, security, and budget requirements.

Go to the DP-800 Exam Prep Hub main page

Create and manage external models (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Implement AI capabilities in database solutions (25–30%)
   --> Design and implement models and embeddings
      --> Create and manage external models


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the major additions to Microsoft SQL Server 2025, Azure SQL Database, and Azure SQL Managed Instance is the ability to directly integrate with external Artificial Intelligence (AI) models. Rather than exporting data to a separate application, developers can invoke Large Language Models (LLMs), embedding models, or other AI services directly from SQL code. This significantly simplifies the development of intelligent database applications.

For the DP-800 exam, candidates should understand how external models are configured, managed, secured, monitored, and consumed from SQL databases. They should also understand the architectural considerations involved in connecting SQL Server to external AI services such as Azure OpenAI Service, Azure AI Foundry models, GitHub Models, or other OpenAI-compatible endpoints.


What Are External Models?

An external model is an AI model that is hosted outside the SQL database but can be invoked securely from SQL statements.

Instead of training or hosting the model inside SQL Server, SQL sends requests to the model through a configured endpoint.

Examples include:

  • Azure OpenAI GPT models
  • Azure AI Foundry models
  • OpenAI API models
  • GitHub Models
  • Cohere models
  • Meta Llama models
  • Mistral AI models
  • Other OpenAI-compatible endpoints

The SQL database becomes an intelligent application layer capable of performing AI operations while leaving model hosting and scaling to specialized AI services.


Why Use External Models?

External AI models provide capabilities such as:

  • Natural language generation
  • Text summarization
  • Classification
  • Translation
  • Sentiment analysis
  • Content generation
  • Question answering
  • Embedding generation
  • Semantic search
  • Retrieval-Augmented Generation (RAG)

Without external models, these tasks would require exporting database data into an application layer before AI processing.


Benefits of External Models

Using external models provides several advantages:

Reduced Application Complexity

Applications can invoke AI directly from SQL instead of implementing additional middleware.

Centralized Data Processing

Data remains closer to where it is stored, reducing unnecessary movement.

Simplified Development

Developers write SQL instead of building custom AI integration layers.

Enterprise Security

Authentication occurs through secure credentials and managed identities.

Scalability

The external AI provider handles model hosting, GPU infrastructure, scaling, and updates.


External Model Architecture

A typical architecture consists of:

Application
│
Azure SQL Database
│
External Model Definition
│
Credential
│
HTTPS Endpoint
│
Azure OpenAI / AI Foundry / OpenAI

SQL sends HTTPS requests to the configured endpoint and returns the model’s response to the calling application.


Components of an External Model

An external model configuration typically includes:

  • Model name
  • Endpoint URL
  • Authentication method
  • API version
  • Deployment name
  • Credentials
  • Optional timeout settings
  • Model capabilities

Supported AI Services

DP-800 focuses primarily on Microsoft’s AI ecosystem.

Common supported services include:

Azure OpenAI Service

Most common deployment option.

Supports:

  • GPT-4
  • GPT-4.1
  • GPT-4o
  • GPT-4 Turbo
  • Embedding models

Azure AI Foundry

Provides access to multiple foundation models from various providers.

Examples include:

  • Meta Llama
  • Mistral
  • Cohere
  • Phi models
  • DeepSeek (where available)

OpenAI-Compatible APIs

SQL can communicate with services implementing the OpenAI API specification.


Creating an External Model

The general process includes:

Step 1

Deploy a model in Azure AI Foundry or Azure OpenAI.


Step 2

Create authentication credentials.

Examples include:

  • API Keys
  • Microsoft Entra ID authentication
  • Managed Identity

Step 3

Create an external model definition inside SQL.

This associates:

  • endpoint
  • deployment
  • credentials
  • model metadata

Step 4

Test connectivity.

Execute SQL queries that invoke the model.


Step 5

Monitor usage.

Review:

  • failures
  • latency
  • token consumption
  • throttling

Authentication Methods

Security is a major exam topic.

Supported authentication methods include:

API Keys

Simple to configure.

Advantages:

  • Easy setup

Disadvantages:

  • Requires secure storage
  • Must be rotated regularly

Microsoft Entra ID

Recommended for enterprise deployments.

Benefits:

  • Central identity management
  • Conditional Access
  • Role-Based Access Control
  • No hardcoded secrets

Managed Identity

Preferred when SQL services interact with Azure services.

Advantages:

  • No passwords
  • Automatic credential rotation
  • Strong security posture

Managing Credentials

Credentials should never be hardcoded into SQL scripts.

Best practices include:

  • Azure Key Vault
  • Managed Identity
  • Secure credential objects
  • Secret rotation
  • Least privilege

Model Configuration Considerations

When selecting a model, evaluate:

  • Latency
  • Cost
  • Context window
  • Maximum tokens
  • Supported languages
  • Multimodal support
  • Structured outputs
  • Function calling
  • Embedding support
  • Regional availability

Model Version Management

AI models evolve frequently.

Developers should:

  • Test new versions
  • Validate prompt compatibility
  • Measure output quality
  • Compare latency
  • Evaluate token costs
  • Deploy gradually

Avoid automatically replacing production models without validation.


Monitoring External Models

Important operational metrics include:

  • Request count
  • Failed requests
  • Average latency
  • Token usage
  • Cost
  • Timeout frequency
  • Authentication failures
  • Rate limiting
  • Model availability

Monitoring may be performed using Azure Monitor, Azure OpenAI metrics, Application Insights, and Log Analytics.


Error Handling

Applications should anticipate failures such as:

  • Network interruptions
  • Authentication failures
  • Invalid prompts
  • Model timeouts
  • Rate limiting
  • Endpoint unavailability
  • Quota exhaustion

Applications should implement:

  • Retry logic
  • Exponential backoff
  • Logging
  • Graceful degradation
  • User-friendly error messages

Cost Management

External AI services typically charge based on token usage.

Cost optimization strategies include:

  • Select smaller models when appropriate.
  • Minimize unnecessary prompts.
  • Cache reusable responses.
  • Use embeddings instead of repeated generation where applicable.
  • Monitor token consumption.
  • Apply rate limits where appropriate.

Security Best Practices

Microsoft recommends:

  • Use Microsoft Entra ID whenever possible.
  • Store secrets securely.
  • Rotate API keys regularly.
  • Restrict network access.
  • Enable auditing.
  • Monitor authentication failures.
  • Apply least privilege.
  • Encrypt data in transit.
  • Avoid sending sensitive information unnecessarily.

Best Practices for DP-800

Candidates should remember the following:

  • External models are hosted outside SQL.
  • SQL communicates with models over secure HTTPS endpoints.
  • Azure OpenAI and Azure AI Foundry are primary Microsoft AI services.
  • Managed Identity is generally preferred over API keys in Azure.
  • Never hardcode secrets.
  • Monitor token usage and latency.
  • Plan for retries and transient failures.
  • Validate model updates before production deployment.
  • Balance performance, cost, and model capabilities.
  • Use the smallest model that satisfies business requirements.

DP-800 Exam Tips

For the exam, be prepared to:

  • Differentiate between external models and local database objects.
  • Understand authentication methods.
  • Identify secure credential storage mechanisms.
  • Select appropriate model types.
  • Monitor AI usage and performance.
  • Recommend enterprise security practices.
  • Manage model lifecycle and versioning.
  • Understand cost optimization strategies.
  • Configure reliable AI integrations.
  • Recognize scenarios where Azure OpenAI or Azure AI Foundry is the preferred solution.

Key Takeaways

Creating and managing external models enables SQL databases to leverage modern AI capabilities without hosting AI infrastructure locally. By securely connecting SQL Server or Azure SQL to services like Azure OpenAI or Azure AI Foundry, developers can incorporate intelligent features such as summarization, classification, semantic search, and RAG directly into database applications. Success depends on proper authentication, secure credential management, monitoring, version control, cost optimization, and selecting the right model for each workload.


Practice Exam Questions

Question 1

A developer wants to enable an Azure SQL Database application to generate natural language summaries using GPT-4o hosted in Azure OpenAI. What is the primary purpose of creating an external model?

A. To copy the AI model into SQL Server memory

B. To allow SQL to securely invoke an externally hosted AI model

C. To convert SQL queries into Python scripts

D. To replace stored procedures with AI-generated code

Correct Answer: B

Explanation: External models define the connection between SQL and an externally hosted AI service. The model remains hosted in Azure OpenAI or another provider, while SQL securely sends requests to it.


Question 2

Which authentication method is generally recommended for Azure SQL Database accessing Azure OpenAI in an enterprise environment?

A. Username and password authentication

B. Shared administrator account

C. Managed Identity

D. Anonymous authentication

Correct Answer: C

Explanation: Managed Identity eliminates the need to store secrets, supports automatic credential rotation, and integrates with Microsoft Entra ID, making it Microsoft’s recommended authentication approach for Azure resources.


Question 3

An organization wants to minimize operational overhead while securely accessing external AI models. Which authentication mechanism best satisfies this requirement?

A. API keys stored in application code

B. SQL logins

C. Managed Identity

D. Local Windows accounts

Correct Answer: C

Explanation: Managed Identity removes the need to manually manage secrets and provides secure, automatic authentication between Azure services.


Question 4

Which factor should be monitored most closely to help control the operational cost of external language models?

A. Token consumption

B. Number of database indexes

C. Memory allocated to SQL Server

D. CPU utilization on the SQL Server

Correct Answer: A

Explanation: Most external LLM providers charge based on token usage. Monitoring prompt and completion tokens helps organizations estimate and manage AI costs.


Question 5

A developer needs to securely store API credentials used by an external model.

Which solution follows Microsoft security best practices?

A. Store the API key in Azure Key Vault

B. Save the API key in a table within the application database

C. Embed the API key in application source code

D. Place the API key in a configuration file committed to source control

Correct Answer: A

Explanation: Azure Key Vault provides secure storage, access policies, auditing, and secret rotation capabilities, making it the recommended location for sensitive credentials.


Question 6

Why should organizations validate new versions of external AI models before deploying them into production?

A. New versions always increase latency.

B. New versions cannot process SQL data.

C. Model behavior, output quality, and performance characteristics may change.

D. SQL Server requires a database restart after every model update.

Correct Answer: C

Explanation: AI model updates can alter response quality, reasoning, formatting, latency, and cost. Testing ensures compatibility with existing applications and prompts.


Question 7

Which capability is provided by Azure AI Foundry that benefits SQL developers?

A. It hosts only Microsoft-developed language models.

B. It provides access to multiple foundation models from different providers.

C. It automatically creates SQL indexes.

D. It replaces Azure SQL Database.

Correct Answer: B

Explanation: Azure AI Foundry offers access to numerous foundation models from Microsoft and third-party providers, enabling developers to select the most appropriate model for their workloads.


Question 8

An external model begins returning timeout errors during peak business hours.

Which application design strategy should be implemented?

A. Disable authentication.

B. Delete and recreate the database.

C. Increase the number of SQL indexes.

D. Implement retry logic with exponential backoff.

Correct Answer: D

Explanation: Transient failures, including timeouts, are common in distributed systems. Retry logic with exponential backoff improves resilience without overwhelming the external service.


Question 9

Which statement best describes an external AI model?

A. It is stored entirely within the SQL database.

B. It executes as a SQL stored procedure.

C. It is hosted externally and accessed through a secure endpoint.

D. It permanently replaces relational queries.

Correct Answer: C

Explanation: External AI models remain hosted outside the database. SQL communicates with them using secure HTTPS requests through configured endpoints.


Question 10

When selecting between multiple external AI models, which combination of evaluation criteria is most appropriate?

A. Number of SQL tables and indexes

B. Latency, cost, capabilities, context window, security, and accuracy

C. File system capacity only

D. Number of database users

Correct Answer: B

Explanation: Choosing the right external model requires balancing functional capabilities with operational considerations such as latency, cost, accuracy, security, supported features, and context window size.


Go to the DP-800 Exam Prep Hub main page

Recommend Azure Monitor configurations, including Application Insights and Log Analytics (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Integrate SQL solutions with Azure services
      --> Recommend Azure Monitor configurations, including Application Insights and Log Analytics


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern SQL applications extend far beyond storing and retrieving data. Today’s applications often expose APIs, integrate with AI services, support microservices, and serve users around the world. As systems become more distributed, monitoring application health, database performance, security, and user activity becomes increasingly important.

Azure Monitor is Microsoft’s unified monitoring platform for collecting, analyzing, visualizing, and acting upon telemetry from Azure resources, applications, virtual machines, containers, databases, and on-premises environments. For SQL AI developers preparing for the DP-800 certification, understanding Azure Monitor—and specifically Application Insights and Log Analytics—is essential for designing highly observable, reliable, and performant database solutions.

The DP-800 exam expects candidates to know when and how to recommend monitoring configurations that support troubleshooting, performance optimization, security monitoring, operational excellence, and AI-enabled database applications.


Understanding Azure Monitor

Azure Monitor is a comprehensive monitoring service that provides:

  • Metrics collection
  • Log collection
  • Distributed tracing
  • Alerting
  • Dashboards
  • Workbooks
  • Performance analytics
  • Diagnostic settings
  • Resource health monitoring

Azure Monitor collects telemetry from virtually every Azure service, including:

  • Azure SQL Database
  • Azure SQL Managed Instance
  • SQL Server on Azure VM
  • Azure App Service
  • Azure Functions
  • Azure Kubernetes Service (AKS)
  • Azure Container Apps
  • Data API Builder (DAB)
  • Azure OpenAI
  • Azure AI Search
  • Microsoft Fabric
  • Virtual Machines

Azure Monitor Architecture

A simplified monitoring architecture looks like this:

Applications
│
Databases
│
Azure Services
│
Diagnostic Settings
│
Azure Monitor
│
┌───────────────┐
│ Metrics │
│ Logs │
│ Traces │
│ Alerts │
└───────────────┘
│
Application Insights
│
Log Analytics
│
Dashboards / Alerts / Workbooks

Core Azure Monitor Components

Azure Monitor consists of several integrated services.

Metrics

Metrics are numerical measurements collected at regular intervals.

Examples include:

  • CPU utilization
  • Memory usage
  • DTU utilization
  • vCore utilization
  • Storage usage
  • Active sessions
  • Requests per second
  • Response times

Metrics are lightweight and optimized for near real-time monitoring.


Logs

Logs contain detailed event information.

Examples:

  • SQL errors
  • Login attempts
  • Application exceptions
  • API requests
  • Deadlocks
  • Security events
  • Query execution details

Logs support historical analysis and forensic investigations.


Alerts

Azure Monitor alerts notify administrators when predefined conditions occur.

Examples include:

  • CPU > 80%
  • Database unavailable
  • Deadlock detected
  • Slow API response
  • Failed deployments
  • Authentication failures

Alerts can trigger:

  • Email
  • SMS
  • Azure Functions
  • Logic Apps
  • Webhooks
  • ITSM integrations

Dashboards

Dashboards combine metrics and logs into a centralized monitoring view.

Typical dashboard elements include:

  • Database performance
  • API latency
  • Error rates
  • Availability
  • Query duration
  • Resource utilization

What Is Application Insights?

Application Insights is an Azure Monitor feature designed to monitor applications.

It automatically collects telemetry such as:

  • HTTP requests
  • Dependencies
  • SQL calls
  • Exceptions
  • Page views
  • Response times
  • Availability tests
  • Distributed traces

Application Insights helps developers understand application behavior rather than infrastructure performance alone.


Telemetry Collected by Application Insights

Application Insights automatically captures:

Requests

Every REST or GraphQL request can be monitored.

Information includes:

  • URL
  • Duration
  • Response code
  • Success or failure
  • Timestamp

Dependencies

Dependencies include calls made by applications to external resources.

Examples:

  • Azure SQL Database
  • Azure OpenAI
  • Azure AI Search
  • Storage Accounts
  • REST APIs
  • Service Bus
  • Cosmos DB

Dependency tracking identifies slow downstream services.


Exceptions

Application Insights records:

  • SQL exceptions
  • .NET exceptions
  • Java exceptions
  • Node.js exceptions
  • Python exceptions

Developers can investigate stack traces and failure frequency.


Performance Counters

Examples include:

  • CPU
  • Memory
  • Thread count
  • Request queue
  • Process utilization

Availability Tests

Availability tests periodically verify that applications remain accessible.

Types include:

  • URL ping tests
  • Multi-step web tests (legacy)
  • Standard availability tests

Useful for:

  • REST APIs
  • Data API Builder endpoints
  • Web applications

Distributed Tracing

Modern applications often involve:

Application

↓

REST API

↓

Data API Builder

↓

Azure SQL Database

↓

Azure OpenAI

↓

Azure AI Search

Application Insights correlates all these operations into a single transaction, allowing developers to trace requests end-to-end.

Benefits include:

  • Root cause analysis
  • Performance bottleneck identification
  • Dependency tracking
  • Service latency analysis

What Is Log Analytics?

Log Analytics is Azure Monitor’s centralized log repository and query engine.

Logs from multiple Azure resources are stored in a Log Analytics Workspace.

Examples include:

  • SQL diagnostics
  • Application Insights logs
  • Azure Activity Logs
  • VM logs
  • Azure Firewall logs
  • Microsoft Defender logs

Log Analytics Workspaces

A Log Analytics Workspace stores telemetry collected across Azure.

Benefits include:

  • Centralized logging
  • Long-term retention
  • Cross-resource analysis
  • Kusto Query Language (KQL) support
  • Security investigations

Multiple Azure resources can send data to a single workspace.


Kusto Query Language (KQL)

Log Analytics uses KQL for querying data.

Example:

requests
| where success == false
| order by timestamp desc

Example:

dependencies
| summarize avg(duration) by target

Example:

exceptions
| summarize count() by type

The DP-800 exam expects familiarity with Log Analytics and awareness that KQL is the query language used to analyze collected telemetry.


Diagnostic Settings

Azure resources send telemetry through Diagnostic Settings.

Diagnostic Settings determine where logs are stored.

Possible destinations include:

  • Log Analytics Workspace
  • Storage Account
  • Event Hub
  • Partner solutions

For Azure SQL Database, diagnostic logs commonly include:

  • SQLInsights
  • Automatic tuning
  • Deadlocks
  • Query Store Runtime Statistics
  • Errors
  • Wait statistics
  • Timeouts

Monitoring Azure SQL Database

Important Azure SQL metrics include:

  • CPU percentage
  • DTU percentage
  • vCore utilization
  • Data IO
  • Log IO
  • Storage percentage
  • Sessions
  • Workers
  • Connections

These metrics help identify capacity issues before users experience failures.


Monitoring Data API Builder (DAB)

DAB deployments should enable:

  • Request logging
  • Response times
  • Authentication failures
  • GraphQL execution errors
  • REST endpoint usage
  • SQL dependency tracking

Application Insights provides excellent visibility into DAB performance.


Monitoring AI-Enabled SQL Applications

Applications integrating Azure OpenAI or Azure AI Search should monitor:

  • API latency
  • Request failures
  • Token usage (where available)
  • Dependency duration
  • Timeout frequency
  • Retry attempts

Dependency tracking in Application Insights helps identify whether delays originate from the database or external AI services.


Azure Monitor Alerts

Common production alerts include:

ConditionAlert
CPU > 80%Warning
DTU > 90%Critical
Deadlock detectedCritical
Failed SQL loginSecurity
API response > 2 secondsWarning
Storage > 85%Capacity alert
Application unavailableCritical

Alerts should prioritize actionable events while minimizing alert fatigue.


Workbooks

Azure Monitor Workbooks create interactive reports using:

  • Metrics
  • Logs
  • Charts
  • Maps
  • Tables
  • KQL queries

Typical workbook examples:

  • SQL performance dashboard
  • API performance trends
  • AI service latency
  • Database growth analysis
  • Security monitoring

Retention Policies

Organizations should configure log retention based on:

  • Compliance requirements
  • Storage costs
  • Investigation needs
  • Security policies

Short retention reduces storage costs, while longer retention supports audits and forensic analysis.


Best Practices for Monitoring SQL Solutions

Microsoft recommends:

  • Enable Application Insights for applications.
  • Send diagnostic logs to Log Analytics.
  • Enable distributed tracing.
  • Configure proactive alerts.
  • Monitor dependencies.
  • Use dashboards for operational visibility.
  • Review telemetry regularly.
  • Monitor failed authentication attempts.
  • Monitor slow SQL queries.
  • Use KQL for troubleshooting.

Common DP-800 Exam Scenarios

You may be asked to determine:

  • Which monitoring service collects application telemetry.
  • When to use Application Insights versus Log Analytics.
  • How to troubleshoot slow SQL queries.
  • Which service stores centralized logs.
  • How to monitor Data API Builder.
  • Which service provides distributed tracing.
  • How to configure alerts for production systems.
  • Which Azure Monitor feature supports long-term log analysis.

DP-800 Exam Tips

Remember these key points:

  • Azure Monitor is the overarching monitoring platform.
  • Application Insights monitors application performance and dependencies.
  • Log Analytics centralizes logs and supports KQL queries.
  • Diagnostic Settings send Azure resource logs to destinations such as Log Analytics.
  • Application Insights supports distributed tracing.
  • Azure Monitor Alerts automate operational notifications.
  • Workbooks provide customizable dashboards and reports.
  • Azure SQL Database metrics help identify capacity and performance issues.
  • Use Application Insights to monitor Data API Builder and AI-enabled applications.
  • KQL is the primary language for querying Log Analytics data.

Practice Exam Questions

Question 1

A company wants to monitor the performance of a .NET application that accesses Azure SQL Database through Data API Builder. The solution must automatically capture request latency, SQL dependencies, exceptions, and distributed traces.

Which Azure service should you recommend?

A. Azure Storage Explorer

B. Azure Monitor Metrics

C. Application Insights

D. Azure Advisor

Answer: C

Explanation: Application Insights is designed to monitor application performance by collecting requests, dependencies, exceptions, distributed traces, and performance telemetry automatically.


Question 2

Your organization needs a centralized repository for logs collected from Azure SQL Database, Azure App Service, Azure Functions, and Application Insights.

Which Azure service should you use?

A. Azure Log Analytics Workspace

B. Azure Backup

C. Azure Key Vault

D. Azure Files

Answer: A

Explanation: A Log Analytics Workspace provides centralized storage and analysis for telemetry collected from multiple Azure resources.


Question 3

An administrator wants to query failed HTTP requests over the past 24 hours using Kusto Query Language (KQL).

Which Azure service provides this capability?

A. Azure Portal Metrics Explorer

B. Azure Cost Management

C. Azure Monitor Alerts

D. Log Analytics

Answer: D

Explanation: Log Analytics stores log data and enables querying through Kusto Query Language (KQL) for detailed analysis and troubleshooting.


Question 4

A development team wants to receive an email whenever Azure SQL Database CPU utilization exceeds 85% for more than five minutes.

Which Azure Monitor feature should be configured?

A. Diagnostic Settings

B. Azure Policy

C. Azure Monitor Alerts

D. Application Insights Availability Tests

Answer: C

Explanation: Azure Monitor Alerts evaluate metric or log conditions and can notify administrators through email, SMS, webhooks, or automated workflows.


Question 5

Which Azure Monitor feature is responsible for routing Azure SQL Database diagnostic logs to a Log Analytics Workspace?

A. Azure Monitor Metrics

B. Diagnostic Settings

C. Availability Tests

D. Resource Locks

Answer: B

Explanation: Diagnostic Settings configure where Azure resource logs are sent, including Log Analytics Workspaces, Storage Accounts, and Event Hubs.


Question 6

A developer needs to identify which downstream dependency is causing increased response times in an AI-enabled application.

Which Application Insights capability should they use?

A. Backup Reports

B. Dependency Tracking

C. Cost Analysis

D. Resource Graph

Answer: B

Explanation: Dependency Tracking records calls to Azure SQL Database, Azure OpenAI, Azure AI Search, REST APIs, and other services, making it easier to identify performance bottlenecks.


Question 7

Your organization wants to monitor whether a public REST endpoint remains accessible from multiple geographic regions.

Which Application Insights feature is most appropriate?

A. Live Metrics

B. Snapshot Debugger

C. Availability Tests

D. Smart Detection

Answer: C

Explanation: Availability Tests periodically check endpoint accessibility and response times from multiple locations, helping detect outages before users report them.


Question 8

Which Azure Monitor capability provides end-to-end visibility by correlating requests across multiple services such as Data API Builder, Azure SQL Database, and Azure OpenAI?

A. Azure Advisor

B. Distributed Tracing

C. Cost Management

D. Azure Policy

Answer: B

Explanation: Distributed Tracing correlates operations across application components, enabling developers to follow a single request through multiple services and identify performance bottlenecks.


Question 9

A database administrator wants to build an interactive dashboard that combines charts, tables, KQL queries, and performance metrics into a single operational view.

Which Azure Monitor feature should be recommended?

A. Azure Workbooks

B. Azure Bastion

C. Microsoft Purview

D. Azure Resource Graph

Answer: A

Explanation: Azure Workbooks create interactive monitoring dashboards that combine metrics, logs, charts, visualizations, and KQL queries for operational reporting.


Question 10

An organization wants to monitor a production SQL solution while minimizing unnecessary notifications that could overwhelm administrators.

Which recommendation represents a monitoring best practice?

A. Generate alerts for every informational event.

B. Disable monitoring during peak usage.

C. Configure actionable alerts based on meaningful thresholds and business impact.

D. Collect only CPU metrics.

Answer: C

Explanation: Effective monitoring focuses on actionable alerts that indicate genuine operational issues. Carefully chosen thresholds reduce alert fatigue while ensuring that critical events receive timely attention.


Go to the DP-800 Exam Prep Hub main page

Configure REST or GraphQL endpoints (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Integrate SQL solutions with Azure services
      --> Configure REST or GraphQL endpoints


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern applications rarely connect directly to a database. Instead, they communicate with APIs that provide a secure, scalable, and well-defined interface for accessing and modifying data. Microsoft Data API Builder (DAB) simplifies this process by automatically exposing SQL Server and Azure SQL Database objects through REST and GraphQL endpoints with minimal custom code.

For the DP-800: Developing AI-Enabled Database Solutions certification exam, candidates should understand how to configure and secure REST and GraphQL endpoints, determine when each API style is appropriate, configure authentication and authorization, expose database objects as entities, and optimize endpoint performance.

This topic builds on previous areas such as configuring entities and Data API Builder configuration files. While entities define what database objects are exposed, endpoints determine how applications interact with those objects.


Learning Objectives

After completing this topic, you should be able to:

  • Explain the purpose of REST and GraphQL endpoints.
  • Understand how Data API Builder exposes SQL data.
  • Configure REST endpoints.
  • Configure GraphQL endpoints.
  • Understand endpoint routing.
  • Configure CRUD operations.
  • Secure API endpoints.
  • Implement authentication and authorization.
  • Optimize endpoint performance.
  • Choose between REST and GraphQL for various scenarios.
  • Troubleshoot common endpoint issues.

Why APIs Are Important

Without APIs:

Application
↓
Direct Database Connection
↓
SQL Database

Applications require:

  • Database credentials
  • Knowledge of table structures
  • SQL query logic
  • Network connectivity to the database

This approach introduces security and maintenance challenges.

With Data API Builder:

Application
↓
REST / GraphQL API
↓
Data API Builder
↓
Azure SQL Database

Benefits include:

  • Simplified development
  • Better security
  • Centralized authentication
  • Controlled data exposure
  • Consistent API design
  • Easier scalability

Understanding REST

REST (Representational State Transfer) is an architectural style that exposes resources through HTTP methods.

Common HTTP verbs include:

MethodPurpose
GETRetrieve data
POSTCreate data
PUTReplace an existing resource
PATCHUpdate part of a resource
DELETERemove data

Example:

GET /api/products

returns:

[
{
"ProductID":1,
"Name":"Laptop"
}
]

REST Endpoint Structure

Typical endpoint format:

https://server/api/entity

Examples:

GET /api/customers
GET /api/orders
POST /api/products
PATCH /api/orders/25
DELETE /api/customers/10

REST uses URLs to identify resources.


Understanding GraphQL

GraphQL is a query language developed to allow clients to request exactly the data they require.

Unlike REST, GraphQL typically uses a single endpoint.

Example:

/graphql

The client submits queries.

Example:

query {
products {
Name
Price
}
}

Only the requested fields are returned.


REST vs. GraphQL

FeatureRESTGraphQL
EndpointsMultipleUsually one
Data returnedFixed by endpointClient specifies fields
Over-fetchingPossibleMinimized
Under-fetchingPossibleRare
CRUD supportNative HTTP verbsQueries and mutations
Learning curveLowerSlightly higher
CachingExcellent HTTP supportMore complex

Neither approach is universally better.

Microsoft expects developers to choose the appropriate API based on application requirements.


Data API Builder Architecture

Data API Builder sits between applications and the database.

Application
↓
REST / GraphQL
↓
Data API Builder
↓
Azure SQL Database

Responsibilities include:

  • Endpoint generation
  • Authentication
  • Authorization
  • SQL execution
  • CRUD operations
  • Entity mapping
  • Relationship handling

Configuring REST Endpoints

REST endpoints are enabled within the Data API Builder configuration.

Developers specify:

  • Entity
  • Source table
  • Permissions
  • Allowed operations

Example concept:

Entity
↓
Customers
↓
REST Enabled

Automatically creates endpoints similar to:

GET /api/customers
POST /api/customers
PATCH /api/customers/15
DELETE /api/customers/15

Configuring GraphQL Endpoints

When GraphQL is enabled, Data API Builder generates a GraphQL schema automatically.

Example query:

query {
customers {
CustomerName
City
}
}

Mutation example:

mutation {
createCustomer(...)
}

Developers do not manually write the GraphQL schema.


Endpoint Routing

Routing determines how incoming requests reach the appropriate entity.

REST example:

/api/products

Routes to:

Products Entity

GraphQL example:

/GraphQL

Routes all requests through:

GraphQL Engine

The GraphQL engine determines which entities participate in the query.


CRUD Operations

Data API Builder supports CRUD operations.

OperationRESTGraphQL
CreatePOSTMutation
ReadGETQuery
UpdatePATCH/PUTMutation
DeleteDELETEMutation

Organizations often disable unnecessary operations.

Example:

Internal reporting API:

Allowed:

  • GET

Disabled:

  • POST
  • PATCH
  • DELETE

This reduces security risks.


Endpoint Configuration Best Practices

Microsoft recommends exposing only the endpoints required by the application.

Good practices include:

  • Enable only necessary entities.
  • Disable unnecessary CRUD operations.
  • Hide internal tables.
  • Use descriptive endpoint names.
  • Keep URL structures consistent.
  • Avoid exposing sensitive objects.

Authentication

Authentication answers:

Who is making the request?

Common authentication methods include:

  • Microsoft Entra ID
  • Managed Identity
  • JWT Bearer Tokens
  • OAuth 2.0
  • API keys (where appropriate)

Microsoft strongly recommends Microsoft Entra ID for Azure-hosted solutions.


Microsoft Entra ID Integration

Data API Builder integrates with Microsoft Entra ID.

Authentication flow:

User
↓
Microsoft Entra ID
↓
Access Token
↓
REST / GraphQL
↓
Data API Builder
↓
Azure SQL Database

Benefits include:

  • Single sign-on
  • Central identity management
  • Multi-factor authentication
  • Conditional Access
  • Token-based authentication

Authorization

Authentication determines identity.

Authorization determines permissions.

Example:

Developer:

Can:

  • Read
  • Update

Auditor:

Can:

  • Read only

Guest:

Can:

  • View public data only

Authorization should follow the principle of least privilege.


Endpoint Security

APIs should never expose more information than necessary.

Security recommendations include:

  • Use HTTPS exclusively.
  • Require authentication.
  • Use Microsoft Entra ID where possible.
  • Implement role-based authorization.
  • Validate client input.
  • Disable unused operations.
  • Avoid exposing sensitive columns.
  • Log API access.
  • Monitor suspicious activity.

Protecting Sensitive Data

Poor API:

Employee
Name
Salary
SSN
PasswordHash

Better API:

Employee
Name
Department
Title

Sensitive fields should remain inaccessible.

Often this is accomplished through:

  • Database views
  • Entity configuration
  • Role-based permissions

Error Handling

REST commonly returns HTTP status codes.

Examples:

CodeMeaning
200Success
201Created
400Bad Request
401Unauthorized
403Forbidden
404Not Found
500Internal Server Error

Applications should use these responses to handle failures appropriately.


GraphQL Error Responses

GraphQL responses may contain both successful data and error information.

Example concept:

{
"data": {
"products": null
},
"errors": [
{
"message":"Unauthorized"
}
]
}

Unlike REST, GraphQL often returns HTTP 200 while including error details in the response body.

Developers should inspect both the HTTP status code and the GraphQL response payload.


Performance Considerations

Well-designed endpoints improve application performance.

Recommendations include:

  • Return only required data.
  • Filter data at the database.
  • Use pagination.
  • Cache relatively static responses.
  • Index frequently searched columns.
  • Avoid returning excessively large result sets.
  • Reduce unnecessary joins.

GraphQL helps minimize over-fetching because clients specify the required fields.


REST Performance

REST benefits from mature HTTP infrastructure.

Advantages include:

  • Browser caching
  • Proxy caching
  • Azure Front Door
  • Azure API Management caching
  • CDN support

REST is often preferred for:

  • Public APIs
  • High-volume read workloads
  • Static content
  • Mobile applications

GraphQL Performance

GraphQL reduces unnecessary network traffic.

Instead of:

GET Customer
GET Orders
GET Products

A single GraphQL query can retrieve all related information.

Example:

{
customer(id:1){
Name
Orders{
OrderDate
Total
}
}
}

This minimizes the number of client-server round trips.


Monitoring Endpoints

Production APIs should be monitored continuously.

Useful Azure services include:

  • Azure Monitor
  • Application Insights
  • Log Analytics
  • Azure API Management analytics

Monitor:

  • Request counts
  • Response times
  • Error rates
  • Authentication failures
  • Throughput
  • Latency

These metrics help identify bottlenecks and security issues.


Common DP-800 Exam Scenarios

You should be comfortable answering questions such as:

  • When should REST be preferred over GraphQL?
  • When is GraphQL more efficient than REST?
  • How are CRUD operations exposed through each API style?
  • Why should unnecessary CRUD operations be disabled?
  • Which authentication mechanism is recommended for Azure-hosted APIs?
  • How should endpoint authorization be implemented?
  • How can API performance be improved?
  • Why is HTTPS required?
  • How does GraphQL reduce over-fetching?
  • What monitoring information should be collected for production APIs?

DP-800 Exam Tips

  • Know the differences between REST and GraphQL.
  • Understand how Data API Builder automatically generates endpoints.
  • Remember that REST typically uses multiple endpoints, while GraphQL commonly uses a single endpoint.
  • Understand the mapping between CRUD operations and HTTP verbs.
  • Recognize the importance of Microsoft Entra ID authentication.
  • Apply least-privilege authorization principles.
  • Use HTTPS for all endpoint communication.
  • Know when GraphQL reduces over-fetching and when REST benefits from HTTP caching.
  • Understand how endpoint configuration affects security, scalability, and performance.

Summary

Configuring REST and GraphQL endpoints is a core competency for developers building modern SQL-backed applications with Microsoft Data API Builder. REST provides resource-oriented endpoints that align naturally with HTTP methods and benefit from widespread tooling and caching support. GraphQL offers a flexible query model that enables clients to retrieve exactly the data they need, reducing over-fetching and minimizing network traffic.

For the DP-800 exam, candidates should understand how Data API Builder automatically generates these endpoints from configured entities, how CRUD operations map to each API style, how to secure endpoints using Microsoft Entra ID and role-based authorization, and how to optimize performance through pagination, filtering, caching, and efficient query design. Mastering these concepts enables developers to build secure, scalable, and maintainable APIs that integrate SQL databases with modern cloud-native applications.


Practice Exam Questions


Question 1

You are deploying Microsoft Data API builder in front of an Azure SQL Database. The security team requires that users authenticate with Microsoft Entra ID before accessing either the REST or GraphQL endpoints.

Which authentication provider should you configure?

A. Anonymous authentication

B. Microsoft Entra ID authentication

C. Basic Authentication

D. SQL Authentication

Correct Answer:

B. Microsoft Entra ID authentication

Explanation

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s recommended authentication mechanism for cloud services. Data API builder supports Microsoft Entra ID authentication, enabling secure token-based authentication for both REST and GraphQL endpoints.

Why the other answers are incorrect:

  • A: Anonymous authentication provides no identity validation.
  • C: Basic authentication transmits usernames and passwords and is generally discouraged.
  • D: SQL Authentication secures the database connection but is not intended for authenticating API consumers.

Question 2

A development team wants consumers of a REST endpoint to retrieve data using standard HTTP semantics.

Which HTTP method should clients use when reading data?

A. POST

B. PUT

C. GET

D. DELETE

Correct Answer:

C. GET

Explanation

REST follows standard HTTP conventions.

  • GET retrieves data.
  • POST creates resources.
  • PUT replaces existing resources.
  • DELETE removes resources.

Using the appropriate HTTP method improves interoperability and aligns with REST best practices.


Question 3

A GraphQL endpoint exposes Customer information.

A client application only requires the customer’s first name and email address.

What is the primary advantage of GraphQL in this scenario?

A. GraphQL automatically encrypts returned data.

B. GraphQL always executes faster than REST.

C. GraphQL allows clients to request only the required fields.

D. GraphQL eliminates authentication requirements.

Correct Answer:

C. GraphQL allows clients to request only the required fields.

Explanation

GraphQL enables clients to specify exactly which fields should be returned, reducing unnecessary data transfer and improving application efficiency.

The other options are incorrect because:

  • GraphQL does not provide encryption.
  • Performance depends on workload.
  • Authentication remains necessary.

Question 4

An organization wants to expose only the Products table through Data API builder.

The Orders and Customers tables must never be accessible.

What is the best configuration?

A. Configure only the Products entity in the DAB configuration.

B. Create views for all tables.

C. Grant db_owner permissions.

D. Disable GraphQL.

Correct Answer:

A. Configure only the Products entity in the DAB configuration.

Explanation

Only configured entities become accessible through DAB endpoints. Tables not defined in the configuration cannot be queried through the generated APIs.

Granting broad database permissions or disabling GraphQL does not prevent REST access.


Question 5

A developer receives HTTP 401 Unauthorized when calling a secured REST endpoint.

Which issue is the most likely cause?

A. The endpoint uses HTTPS.

B. The client failed to provide a valid authentication token.

C. The SQL query contains joins.

D. Pagination is enabled.

Correct Answer:

B. The client failed to provide a valid authentication token.

Explanation

HTTP 401 indicates that authentication failed or credentials were not supplied.

Typical causes include:

  • Missing bearer token
  • Expired token
  • Invalid token
  • Incorrect authentication configuration

The remaining options are unrelated to authentication failures.


Question 6

Your organization wants GraphQL clients to create new database records.

Which GraphQL operation should the clients perform?

A. Query

B. Subscription

C. Mutation

D. Schema

Correct Answer:

C. Mutation

Explanation

GraphQL defines three primary operation types:

  • Query → Read data
  • Mutation → Insert, update, or delete data
  • Subscription → Receive real-time updates (where supported)

Creating records is accomplished using mutations.


Question 7

An application experiences slower response times because every request repeatedly retrieves identical reference data.

Which feature would most likely improve endpoint performance?

A. Increase SQL authentication timeout.

B. Enable response caching where appropriate.

C. Replace GraphQL with SOAP.

D. Disable indexes.

Correct Answer:

B. Enable response caching where appropriate.

Explanation

Caching reduces repeated database reads for frequently requested data.

Benefits include:

  • Lower latency
  • Reduced database workload
  • Improved scalability

Disabling indexes would significantly reduce performance.


Question 8

Which statement best describes GraphQL schemas?

A. They define the structure of available queries, mutations, and data types.

B. They replace SQL indexes.

C. They encrypt REST endpoints.

D. They create database backups.

Correct Answer:

A. They define the structure of available queries, mutations, and data types.

Explanation

The GraphQL schema acts as the contract between clients and the API.

It specifies:

  • Available object types
  • Fields
  • Queries
  • Mutations
  • Relationships

It does not manage indexing, encryption, or backups.


Question 9

Your organization deploys Data API builder to production.

Which practice best protects REST and GraphQL endpoints?

A. Enable anonymous access for easier testing.

B. Store secrets directly in configuration files.

C. Require HTTPS and strong authentication.

D. Disable authorization checks.

Correct Answer:

C. Require HTTPS and strong authentication.

Explanation

Production APIs should always:

  • Use HTTPS
  • Authenticate users
  • Authorize requests
  • Protect credentials
  • Follow least-privilege principles

Anonymous access and embedded secrets introduce significant security risks.


Question 10

A developer modifies a Data API builder configuration file by adding a new entity.

What must occur before clients can use the new endpoint?

A. Restart or redeploy the Data API builder service so the updated configuration is loaded.

B. Rebuild the Azure SQL Database.

C. Delete the GraphQL schema.

D. Recreate the database indexes.

Correct Answer:

A. Restart or redeploy the Data API builder service so the updated configuration is loaded.

Explanation

After modifying the DAB configuration, the running service must reload the updated configuration. Depending on the hosting environment, this typically involves restarting the application or redeploying the container or service.

Database rebuilding, deleting the GraphQL schema, and recreating indexes are unrelated to exposing newly configured endpoints.


Exam Tips for DP-800

For the exam, you should be comfortable with:

  • Configuring REST and GraphQL endpoints using Microsoft Data API builder.
  • Understanding REST HTTP methods (GET, POST, PUT/PATCH, DELETE).
  • Understanding GraphQL queries, mutations, and schemas.
  • Configuring Microsoft Entra ID authentication.
  • Applying authorization using database permissions and DAB configuration.
  • Exposing only intended database objects.
  • Using HTTPS to secure endpoint communications.
  • Improving performance through caching and efficient endpoint design.
  • Deploying configuration changes safely.
  • Understanding the differences and appropriate use cases for REST versus GraphQL.

Go to the DP-800 Exam Prep Hub main page

Describe the Azure SQL family of products including Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure Virtual Machines (DP-900 Exam Prep)

This post is a part of the DP-900: Microsoft Azure Data Fundamentals Exam Prep Hub. 
This topic falls under these sections:
Identify considerations for relational data on Azure (20–25%)
--> Describe relational Azure data services
--> Describe the Azure SQL family of products including Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure Virtual Machines


Note that there are 10 practice questions (with answers and explanations) for each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available on the hub below the exam topics section.

Microsoft Azure provides a family of relational database services collectively known as the Azure SQL family. These services are based on the Microsoft SQL Server engine and are designed to support a wide range of workloads—from fully managed cloud databases to lift-and-shift migrations.

For the DP-900 exam, you should understand the differences, use cases, and key features of:

  • Azure SQL Database
  • Azure SQL Managed Instance
  • SQL Server on Azure Virtual Machines

Overview of the Azure SQL Family

All Azure SQL offerings:

  • Use the Microsoft SQL Server engine
  • Support Structured Query Language (SQL)
  • Are designed for relational data workloads
  • Provide varying levels of management control vs automation

💡 The key difference is how much control you have vs how much Azure manages for you.


1. Azure SQL Database

Azure SQL Database is a fully managed Platform as a Service (PaaS) offering.

Key Features

  • Fully managed by Azure (patching, backups, updates)
  • Built-in high availability
  • Automatic scaling options
  • Intelligent performance tuning
  • Minimal administrative overhead

Deployment Options

  • Single database (isolated)
  • Elastic pool (shared resources across multiple databases)

Use Cases

  • Cloud-native applications
  • Modern web and mobile apps
  • Applications that do not require full SQL Server feature compatibility

✔ Best for: Simplicity, scalability, and minimal management


2. Azure SQL Managed Instance

Azure SQL Managed Instance is a Platform as a Service (PaaS) offering with near 100% compatibility with SQL Server.

Key Features

  • Managed service with automated patching and backups
  • Supports most SQL Server features (e.g., SQL Agent, linked servers)
  • Instance-level features (unlike Azure SQL Database)
  • Runs inside a virtual network (VNet)

Use Cases

  • Migration of on-premises SQL Server applications
  • Applications requiring instance-level features
  • Lift-and-shift scenarios with minimal changes

✔ Best for: Compatibility with existing SQL Server environments


3. SQL Server on Azure Virtual Machines

SQL Server on Azure Virtual Machines is an Infrastructure as a Service (IaaS) offering.

Key Features

  • Full control over the operating system and SQL Server
  • You manage patching, backups, and maintenance
  • Supports all SQL Server features
  • Easy lift-and-shift migration

Use Cases

  • Legacy applications requiring full control
  • Custom configurations or unsupported features in PaaS
  • Scenarios requiring OS-level access

✔ Best for: Maximum control and full SQL Server compatibility


Key Differences at a Glance

FeatureAzure SQL DatabaseAzure SQL Managed InstanceSQL Server on Azure VM
Service TypePaaSPaaSIaaS
ManagementFully managedMostly managedCustomer-managed
SQL Server CompatibilityPartialNear 100%100%
OS AccessNoNoYes
Use CaseCloud-native appsMigration with minimal changesFull control / legacy apps

Choosing the Right Option

Think of the Azure SQL family as a spectrum:

  • Most managed → Azure SQL Database
  • Balanced → Azure SQL Managed Instance
  • Most control → SQL Server on Azure VM

💡 DP-900 Tip:
Questions often test your ability to match a scenario with the correct service based on:

  • Level of control required
  • Compatibility needs
  • Migration vs cloud-native design

Why This Matters for DP-900

On the exam, you may be asked to:

  • Identify differences between Azure SQL offerings
  • Choose the appropriate service for a scenario
  • Understand PaaS vs IaaS trade-offs
  • Recognize management responsibilities

Summary — Exam-Relevant Takeaways

✔ All Azure SQL services are based on SQL Server
✔ Use SQL for querying and management

✔ Azure SQL Database

  • Fully managed
  • Best for modern cloud apps

✔ Azure SQL Managed Instance

  • High compatibility with SQL Server
  • Best for migrations

✔ SQL Server on Azure VM

  • Full control (IaaS)
  • Best for legacy or highly customized environments

✔ Key decision factor = control vs management


Go to the Practice Exam Questions for this topic.

Go to the DP-900 Exam Prep Hub main page.