title: Can't Create Azure SQL Database Users Mapped to Azure AD Identities using Service Principal
body: <p>As part of an Azure SQL database automation solution, I'm trying to create Azure SQL database users <a href="https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure#create-contained-database-users-in-your-database-mapped-to-azure-ad-identities" rel="noreferrer">mapped to Azure AD Identities</a>, using a <strong>service principal</strong>.</p>
  
  <p>The result is an error message saying: <strong>Principal 'AAD_User_UPN_or_Group_Name' could not be found at this time. Please try again later.</strong></p>
  
  <p>The database users can be created using my own user account, following exactly the same procedure.</p>
  
  <p>Please find more details below:</p>
  
  <ul>
  <li>The service principal is a member of an Azure AD security group</li>
  <li>The group is set as the Active Directory Admin of an Azure SQL server</li>
  <li>My own user account is also a member of this group</li>
  <li>The service principal has <strong>Directory Reader</strong> and <strong>Directory Writer</strong> role in the Azure Active Directory</li>
  <li>My own user account is a regular member without any admin role in the Azure Active Directory</li>
  </ul>
  
  <p>The service principal executes following T-SQL statement inside the Azure SQL database:</p>
  
  <pre><code>CREATE USER [AAD_User_UPN_or_Group_Name] FROM EXTERNAL PROVIDER;
  </code></pre>
  
  <p>The returned error message is:</p>
  
  <pre><code>Principal 'AAD_User_UPN_or_Group_Name' could not be found at this time. Please try again later.
  </code></pre>
  
  <p>When the same T-SQL statement is triggered by my own user account, it runs successfully and the user is created.</p>
  
  <p>Your help or suggestions are highly appreciated.</p>