title: Creating a SQL Azure user that cannot create tables
body: <p>I just have to create a new user on an SQL Azure database, that can SELECT/INSERT/UPDATE/DELETE from every table, and execute every proc, but CANNOT CREATE/ALTER/DROP anything.</p>
  
  <p>In other words, I need a new user that cannot run DDL commands against the database.</p>
  
  <p>I've already managed to create the login and the user (on master schema).
  Any help?</p>
  
  <p>-- Edit 1 
  As soon as I created the new user on the SQL Azure, it already can create tables and procs (so, it's fundamental to REVOKE that power). Here arte the commands issued from the Master database:</p>
  
  <pre><code>CREATE LOGIN Sistema WITH PASSWORD = 'XXX';
  
  CREATE USER Sistema 
  FOR LOGIN Sistema 
  WITH DEFAULT_SCHEMA = dbo; --This command was run on Master database, AND on my MainDatabase.
  </code></pre>
  
  <p>--Solution (based on Jisaak's answer):</p>
  
  <pre><code>--After creating login and user, I issued those commands from MainDatabase:
  
  EXEC sp_addrolemember db_datareader, Sistema
  EXEC sp_addrolemember db_datawriter, Sistema
  EXEC sp_droprolemember db_owner, Sistema    --As it appears, SQL Azure defaults new users as "db_owners", which must be revoked
  </code></pre>