This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Integrate SQL solutions with Azure services
      --> Create configuration files for Data API builder (DAB)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Advanced Entity Configuration

While a basic DAB configuration can expose an entire table with only a few lines of JSON, enterprise applications typically require much more granular control. Developers can customize how entities are exposed, which operations are permitted, and who can access specific data.

Advanced entity configuration allows you to:

• Rename API endpoints
• Restrict CRUD operations
• Configure role-based permissions
• Expose only selected database objects
• Map views and stored procedures
• Customize GraphQL object names
• Define relationships between entities

This flexibility allows developers to build secure APIs without writing application code.

Configuring Entity Permissions

One of the most important sections of a DAB configuration file is the permissions section.

Example:

"permissions": [
  {
    "role": "anonymous",
    "actions": [ "read" ]
  }
]

Permissions determine which operations a role may perform.

Supported actions include:

• Read
• Create
• Update
• Delete
• Execute (stored procedures)

For DP-800, understand that permissions are configured at the entity level rather than the database level.

Role-Based Authorization

DAB uses roles to authorize requests after a user has been authenticated.

Example roles might include:

• anonymous
• authenticated
• reader
• contributor
• manager
• administrator

Example:

"permissions": [
{
    "role": "reader",
    "actions": [ "read" ]
},
{
    "role": "administrator",
    "actions": [ "create","read","update","delete" ]
}
]

In this example:

Readers can only retrieve data.

Administrators can perform all CRUD operations.

Field-Level Permissions

Some applications should expose only specific columns.

For example:

Employee table

• EmployeeID
• Name
• Department
• Salary
• SocialSecurityNumber

Instead of exposing every column, DAB can restrict access through permissions and by configuring the entity to expose only approved fields (combined with database permissions where appropriate).

Although SQL permissions remain the primary security boundary, DAB provides another layer of API security.

Using Views Instead of Tables

Many organizations expose SQL views instead of tables.

Advantages include:

• Hide sensitive columns
• Simplify queries
• Enforce business rules
• Reduce accidental data exposure

Example

"source": {
    "object": "dbo.vwCustomerSummary",
    "type": "view"
}

Views are often considered a security best practice.

Exposing Stored Procedures

DAB supports stored procedures as API endpoints.

Example

"source": {
    "object": "dbo.GetSalesSummary",
    "type": "stored-procedure"
}

REST example

POST /api/GetSalesSummary

GraphQL example

mutation

Stored procedures are especially useful when:

• Complex business logic exists
• Multiple tables must be updated
• Validation is required
• Reporting queries are expensive

Authentication Providers

Authentication determines who a user is.

Authorization determines what that user may do.

Data API builder supports multiple authentication providers.

Common providers include:

• Anonymous
• Microsoft Entra ID
• Azure Static Web Apps Authentication
• JSON Web Tokens (JWT)
• OAuth providers

The authentication provider is configured in the runtime section.

Microsoft Entra ID Authentication

Microsoft recommends Microsoft Entra ID for production environments.

Benefits include:

• Enterprise identity management
• Single Sign-On (SSO)
• Multi-factor authentication
• Conditional Access
• Managed identities
• Centralized security

Using Entra ID reduces the need to manage usernames and passwords within applications.

Azure Static Web Apps Authentication

When DAB is deployed alongside Azure Static Web Apps, authentication can be handled automatically.

Supported providers include:

• Microsoft
• GitHub
• Google
• X (formerly Twitter) (where supported)
• Custom OpenID Connect providers

The application receives authenticated user information without requiring developers to implement custom login functionality.

JSON Web Tokens (JWT)

JWT authentication is commonly used in REST APIs.

Workflow:

1. User authenticates.
2. Identity provider issues a JWT.
3. Client sends the JWT with each request.
4. DAB validates the token.
5. Permissions are applied.

JWT authentication enables stateless API security.

Managed Identity

Managed Identity is one of Microsoft’s preferred authentication methods for Azure resources.

Instead of storing credentials:

Username
Password

Azure automatically manages an identity for the application.

The application authenticates using Azure Active Directory (Microsoft Entra ID).

Benefits include:

• No passwords
• Automatic credential rotation
• Improved security
• Easier administration
• Reduced risk of credential leakage

This is a frequently tested DP-800 topic.

Connecting DAB to Azure SQL with Managed Identity

Typical flow:

Azure App Service
↓
Managed Identity
↓
Microsoft Entra ID
↓
Azure SQL Database

No SQL username or password needs to be stored in the configuration file.

Connection Strings with Managed Identity

Instead of:

Server=...
User ID=admin
Password=...

Developers use an authentication method supported by Azure SQL that relies on Managed Identity (for example, Authentication=Active Directory Managed Identity in the connection string, depending on the client and environment).

Benefits include:

• No secrets
• Easier rotation
• Improved compliance
• Better security posture

Cross-Origin Resource Sharing (CORS)

Modern web applications often call APIs hosted on different domains.

Example:

Website

https://contoso.com

API

https://api.contoso.com

Without CORS configuration:

Browser blocks the request.

DAB allows developers to configure permitted origins.

Example

Allowed Origins
https://contoso.com

This prevents unauthorized websites from making browser-based requests to the API.

Azure App Service Deployment

DAB is frequently deployed to Azure App Service.

Deployment steps typically include:

1. Publish DAB.
2. Upload configuration file.
3. Configure environment variables.
4. Configure Managed Identity.
5. Grant Azure SQL permissions.
6. Enable HTTPS.
7. Test REST endpoints.
8. Test GraphQL endpoints.

Azure Container Apps

Container Apps provide a lightweight alternative to Kubernetes.

Benefits include:

• Autoscaling
• Container support
• Easy deployment
• Native Azure integration
• Lower operational overhead than managing a Kubernetes cluster

DAB runs well inside containers.

Azure Kubernetes Service (AKS)

Large organizations often deploy DAB using Kubernetes.

Benefits include:

• High availability
• Rolling updates
• Autoscaling
• Container orchestration
• Enterprise management

The configuration file remains largely the same regardless of the hosting platform.

Azure Static Web Apps Integration

One common architecture is:

Static Web App
↓
Data API Builder
↓
Azure SQL Database

Advantages include:

• Secure authentication
• Built-in authorization integration
• REST support
• GraphQL support
• Low operational cost
• Automatic HTTPS

Environment Variables

Instead of storing values inside the configuration file:

Connection String
JWT Secret
API Keys
URLs

Developers store them as environment variables.

Benefits include:

• Easier deployments
• Better security
• CI/CD friendly
• No secrets in Git
• Different values for Dev/Test/Production

Azure Key Vault

Environment variables may reference secrets stored in Azure Key Vault.

Typical secrets include:

• Database passwords
• Certificates
• API keys
• OAuth secrets
• Encryption keys

Benefits include:

• Centralized secret management
• Access auditing
• Automatic secret rotation
• Fine-grained access control
• Compliance support

Logging

Production deployments should enable logging.

Common information includes:

• Authentication failures
• API requests
• SQL errors
• Performance metrics
• Authorization failures

Logs can be integrated with:

• Azure Monitor
• Application Insights
• Log Analytics

These tools help diagnose operational issues and monitor API health.

Common Configuration Mistakes

Many deployment failures result from configuration errors rather than application bugs.

Common mistakes include:

• Invalid JSON syntax
• Missing commas or braces
• Incorrect object names
• Typographical errors in table names
• Invalid connection strings
• Missing environment variables
• Authentication configuration errors
• Missing permissions
• Disabled REST endpoints
• Disabled GraphQL endpoints

Always validate configuration before deployment.

Troubleshooting REST Endpoints

If an endpoint does not respond correctly, verify:

• Is REST enabled?
• Does the entity exist?
• Does the SQL object exist?
• Is authentication configured correctly?
• Are permissions assigned?
• Is the endpoint path correct?
• Is the API reachable over HTTPS?

These are common troubleshooting steps in real-world deployments.

Troubleshooting GraphQL

If GraphQL queries fail:

• Verify GraphQL is enabled.
• Check entity names.
• Confirm relationships are configured correctly.
• Validate user permissions.
• Review authentication settings.
• Inspect logs for schema generation or query errors.

GraphQL errors are often related to configuration rather than SQL syntax.

DAB Best Practices

Microsoft recommends the following practices:

• Use Microsoft Entra ID whenever possible.
• Prefer Managed Identity over passwords.
• Store secrets in Azure Key Vault.
• Keep configuration files in source control.
• Exclude secrets from Git repositories.
• Use separate environments for development, testing, and production.
• Follow the principle of least privilege.
• Expose only the database objects required by the application.
• Prefer views when exposing sensitive data.
• Monitor API activity using Azure Monitor and Application Insights.
• Regularly review permissions and authentication settings.
• Test configuration changes in a non-production environment before deployment.

Real-World Example

A retail company wants to expose product information to a web application.

Requirements:

• Customers can view products.
• Employees can update inventory.
• Administrators can manage all data.
• No passwords should be stored in source control.
• APIs should support both REST and GraphQL.
• Azure SQL Database is used as the backend.

A recommended DAB solution would include:

• Azure SQL Database as the data source.
• Microsoft Entra ID for authentication.
• Managed Identity for connecting to Azure SQL.
• Entity permissions granting read access to customers, update access to employees, and full CRUD access to administrators.
• REST and GraphQL endpoints enabled.
• Environment variables and Azure Key Vault for configuration and secrets.
• Deployment to Azure App Service or Azure Container Apps with HTTPS enabled.

DP-800 Exam Tips

When preparing for the DP-800 exam, be sure you can:

• Explain the purpose of each major section in a DAB configuration file.
• Configure data sources for Azure SQL Database.
• Understand how entities map to tables, views, and stored procedures.
• Configure REST and GraphQL endpoints.
• Implement role-based permissions.
• Distinguish authentication from authorization.
• Explain the benefits of Microsoft Entra ID and Managed Identity.
• Describe how environment variables and Azure Key Vault improve security.
• Recognize appropriate Azure hosting options for DAB.
• Identify common configuration and deployment errors.
• Apply security best practices when exposing database objects through APIs.

Practice Exam Questions

Question 1

Your organization wants to expose data from an Azure SQL Database through Data API builder. You want to specify the database connection information in the DAB configuration file.

Which section of the configuration file should you modify?

A. runtime

B. entities

C. data-source

D. authentication

Correct Answer: C

Explanation

The data-source section defines the backend database used by Data API builder. It contains information such as the database type, connection string, and provider.

• The runtime section controls API behavior.
• The entities section defines which database objects are exposed.
• Authentication settings belong under the runtime configuration.

Question 2

A development team wants to avoid storing database passwords in the DAB configuration file stored in GitHub.

What is the recommended approach?

A. Encrypt the password using Base64.

B. Store the connection string in an environment variable or Azure Key Vault.

C. Place the password in a separate JSON file.

D. Store the password inside the runtime section.

Correct Answer: B

Explanation

Microsoft recommends storing sensitive information such as connection strings and secrets outside the configuration file by using environment variables or Azure Key Vault. This improves security and supports multiple deployment environments.

Base64 encoding is not encryption and does not protect credentials.

Question 3

A developer creates an entity that maps to the Products table.

What is the primary purpose of the entity definition?

A. Configure Azure authentication.

B. Define database backup policies.

C. Specify which database object is exposed through REST and GraphQL endpoints.

D. Enable SQL auditing.

Correct Answer: C

Explanation

Entities map database objects—such as tables, views, or stored procedures—to automatically generated REST and GraphQL endpoints.

Authentication, auditing, and backup configuration are handled elsewhere.

Question 4

A company wants every database API to support both REST and GraphQL.

Which runtime configuration should be enabled?

A. Enable REST and GraphQL in the runtime section.

B. Configure only the data-source section.

C. Configure only entity permissions.

D. Enable Azure Monitor.

Correct Answer: A

Explanation

The runtime section controls whether REST and GraphQL endpoints are available. Enabling both services allows clients to access the exposed entities through either API style.

Azure Monitor provides monitoring but does not enable APIs.

Question 5

A developer wants to expose a SQL view instead of a table.

Why is this commonly recommended?

A. Views automatically improve SQL Server performance.

B. Views prevent SQL injection attacks.

C. Views can simplify data exposure and hide sensitive columns.

D. Views eliminate the need for permissions.

Correct Answer: C

Explanation

Views allow organizations to expose only the required columns and business logic while hiding sensitive information. They also simplify complex joins and provide an additional abstraction layer.

Views do not automatically improve performance or eliminate security requirements.

Question 6

Your Data API builder application is deployed to Azure App Service.

How should the application authenticate to Azure SQL Database without storing credentials?

A. SQL Authentication

B. Windows Authentication

C. Shared Access Signature (SAS)

D. Managed Identity

Correct Answer: D

Explanation

Managed Identity allows Azure resources to authenticate securely without storing usernames or passwords. Azure automatically manages credential creation and rotation.

This is Microsoft’s recommended authentication approach for Azure-hosted applications.

Question 7

A company wants to expose a stored procedure through Data API builder.

Which object type should be configured?

A. Table

B. View

C. Function

D. Stored-procedure

Correct Answer: D

Explanation

When exposing stored procedures through DAB, the entity’s source type should be configured as stored-procedure.

Tables and views are configured using their respective object types.

Question 8

A web application hosted at https://contoso.com calls a Data API builder service hosted at https://api.contoso.com, but the browser blocks the request.

Which feature should be configured?

A. Transparent Data Encryption

B. Always Encrypted

C. Cross-Origin Resource Sharing (CORS)

D. Dynamic Data Masking

Correct Answer: C

Explanation

Because the application and API are hosted on different origins, the browser enforces the Same-Origin Policy. Configuring CORS allows approved origins to access the API.

Database encryption technologies do not affect browser security policies.

Question 9

An organization uses Microsoft Entra ID to authenticate users accessing Data API builder.

What is the primary benefit?

A. Automatic SQL indexing

B. Enterprise identity management with centralized authentication

C. Automatic query optimization

D. Elimination of REST endpoints

Correct Answer: B

Explanation

Microsoft Entra ID provides centralized authentication, Single Sign-On, Conditional Access, Multi-Factor Authentication, and enterprise identity management.

It does not optimize SQL queries or change API functionality.

Question 10

A development team stores its DAB configuration file in Git and uses Azure DevOps pipelines to deploy to Development, Test, and Production.

Which design best supports this deployment strategy?

A. Maintain separate configuration files containing hardcoded credentials for every environment.

B. Store all passwords directly inside the JSON configuration file.

C. Disable authentication during deployment.

D. Store secrets externally using environment variables or Azure Key Vault while using a common configuration file.

Correct Answer: D

Explanation

A single configuration file combined with environment-specific variables or Azure Key Vault simplifies CI/CD deployments while keeping secrets out of source control. This approach follows Microsoft’s security best practices and makes deployments easier to maintain across multiple environments.

Exam Essentials

For the DP-800 exam, be comfortable with the following concepts:

• Understand the purpose of the data-source, runtime, and entities sections of a DAB configuration file.
• Know how Data API builder automatically exposes SQL tables, views, and stored procedures as REST and GraphQL APIs.
• Recognize when to use tables, views, or stored procedures as entities.
• Understand how REST and GraphQL endpoints are enabled and configured.
• Know the difference between authentication and authorization.
• Understand role-based permissions within DAB.
• Understand why Microsoft recommends Microsoft Entra ID and Managed Identity for production deployments.
• Know why secrets should be stored in Azure Key Vault or environment variables instead of configuration files.
• Understand how CORS enables secure browser-based access across different origins.
• Recognize common Azure hosting options, including Azure App Service, Azure Container Apps, Azure Kubernetes Service (AKS), and Azure Static Web Apps.
• Be able to identify common configuration and deployment issues, including invalid JSON, missing environment variables, incorrect entity mappings, and permission misconfigurations.

Final DP-800 Takeaways

Data API builder (DAB) is designed to dramatically simplify API development by exposing database objects through configuration rather than custom code. For the DP-800 exam, Microsoft expects candidates to understand how to configure secure, maintainable, and cloud-ready APIs that integrate with Azure SQL Database and other supported data sources.

Pay particular attention to these frequently tested areas:

• The structure and purpose of the DAB configuration file.
• Entity definitions and source object mapping.
• REST versus GraphQL endpoint configuration.
• Authentication with Microsoft Entra ID.
• Passwordless access using Managed Identity.
• Secrets management with Azure Key Vault and environment variables.
• Role-based authorization and least-privilege access.
• Secure deployment practices in Azure environments.

Mastering these concepts will prepare you not only for the DP-800 certification exam but also for implementing secure, production-ready Data API builder solutions in real-world Azure environments.

Go to the DP-800 Exam Prep Hub main page