title: Azure SQL and Web Application User Identity
body: <p>I'm looking for suggestions on how developers pass the identity of a their logged in user to the database when making updates. </p>
  
  <p>To keep it simple, imagine we are using simple ADO.NET SQLCommand to insert some rows into a log table. The row has a UserId column which needs populated with the logged in user rather than the generic userId used on the connection string.</p>
  
  <p>Obviously, the SQLCommand could accept in a parameter of "UserId" and simply use this. But I'm wondering if there are any better options to save having to manually pass this for every command.</p>
  
  <p>I've looked at using Azure AD to provide ADFS for logging into the web application, then using this identity on the connection string to the database. This works well, but I am concerned that we are giving an application user account direct access to the database - this might be ok, but seems like a risk. If a malicious user some how managed to get SSMS to our DB server, they'd have a username and password they could use. </p>
  
  <p>Additionally, if we were not using AD to manage our user accounts - ASP.Net Membership for example... what could we do here? Are their any properties we can set at connection time?</p>
  
  <p>Thanks
  David</p>