I am trying to grant a Security Group within our company's Azure environment that is found in Azure AD. I have successfully granted users' rights to the db_datareader, writer, owner roles. But I am trying to add a Group to one of these roles and the error I get below.
I am an AD Admin of the SQL Server in Azure, and I confirmed that the Security Group is synced and found in our Azure AD environment. I have also confirmed running the commands below against the actual database and the master db.
I know that within Azure SQL you can run the T-SQL command to add a user by their UPN, this works fine:
CREATE USER [firstname.lastname@example.org] FROM EXTERNAL PROVIDER; ALTER ROLE [db_datawriter] ADD MEMBER [email@example.com];
But when running the below it provides an error
ALTER ROLE [db_datawriter] ADD MEMBER [firstname.lastname@example.org];
Msg 15151, Level 16, State 1, Line 1 Cannot add the principal 'email@example.com', because it does not exist or you do not have permission.
Do I also need to create a Group for the Sec Group as well? As in:
CREATE GROUP [firstname.lastname@example.org] FROM EXTERNAL PROVIDER; -- "GROUP" is not correct syntax.
CREATE USER [email@example.com] FROM EXTERNAL PROVIDER;
This article did not provide any details I could find on this topic but adding users.