There is an Azure Function App that has the ‘system assigned identity’ enabled and a ‘user assigned identity’ (uai) linked. The ‘uai’ is also created under the Azure SQL database it needs to interact with and has db roles assigned…

/****** Object:  User [isl-lds-test-uai-emis]    Script Date: 25/07/2024 12:46:12 ******/
CREATE USER [isl-xxx-abc-uai-emis] FROM  EXTERNAL PROVIDER  WITH DEFAULT_SCHEMA=[dbo]
GO
EXEC sp_addrolemember 'db_datareader', 'isl-xxx-abc-uai-emis'
EXEC sp_addrolemember 'db_datawriter', 'isl-xxx-abc-uai-emis'
EXEC sp_addrolemember 'db_ddladmin', 'isl-xxx-abc-uai-emis'

I can see inn the database the correct appId is there…

SELECT name, type, type_desc, CAST(CAST(sid as varbinary(16)) as uniqueidentifier) as appId
FROM sys.database_principals
where name = 'isl-xxx-abc-uai-emis';

name    type    type_desc   appId
isl-xxx-abc-uai-emis    E   EXTERNAL_USER   56D7C2DE-XXXX-ABCD-B971-C13C5C8B2BAB

The error I am seeing in ‘log analytics workspace’ is…

Result: Failure Exception: Microsoft.Data.SqlClient.SqlException (0x80131904): The user attempting to perform this operation does not have permission as it is currently logged in as a member of an Azure Active Directory (AAD) group but does not have an associated database user account. A user account is necessary when setting the ownership of an object. To resolve this error, create an Azure AD user from external provider, then rerun the statement. at Microsoft.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at Microsoft.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at

I am not sure what else to check? ( i have access to both ‘application insights’ and ‘log analytics workspace’?)

How can I tell what identity is being used to connection to the database – in the logs somewhere?