Restrict contained SQL Azure user to read-only access
This should never happen. db_datareader will grant only select access to the database.

I used your query in my Azure database and I couldn't create a table, the user got only select access to the database.

Either the user got elevated access or else you might be logged in with the administrator account. Do the same test in a different user database (just to ensure the user didn't get created already) and then connect using the user name and run the query below.

SELECT DatabaseName=DB_NAME(),
    UserName=USER_NAME(),
    x.DoesUserHasAccess,
    a.entity_name,
    a.permission_name
FROM sys.fn_my_permissions(NULL, 'DATABASE') a
    CROSS APPLY
     (
         SELECT DoesUserHasAccess = HAS_PERMS_BY_NAME(
                                        DB_NAME(),
                                        a.entity_name,
                                        a.permission_name
                                                     )
     ) x
WHERE x.DoesUserHasAccess = 1;


When I tested for the same user it returned only select access.