CREATE USER FROM EXTERNAL PROVIDER fails with SQL error 33134

TL;DR: The documented fix is to update the policy to allow access to the Microsoft Graph application, application ID 00000003-0000-0000-c000-000000000000. error 33134 is not a SQL permission problem, its an Entra policy problem. Read the message inside the error.

CREATE USER FROM EXTERNAL PROVIDER fails with SQL error 33134

Fix

1. The documented fix is to update the policy to allow access to the Microsoft Graph application, application ID 00000003-0000-0000-c000-000000000000. Expected: this specific failure stops.

2. Sign in as a regular user and run the same CREATE USER statement again and it succeeds. Expected: this specific failure stops.

3. Always run the initial CREATE USER as a user, not a service principal. Expected: this specific failure stops.

Details

error 33134 is not a SQL permission problem, its an Entra policy problem. Read the message inside the error. If it says access is denied or MFA enrollment is required, the cause is usually a Conditional Access policy blocking the lookup. If the message says access between first-party applications must be handled via preauthorization, the cause is different: you ran the command while signed in as a service principal.

When to use

You hit exactly this: CREATE USER FROM EXTERNAL PROVIDER fails with SQL error 33134.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

the tool named in the title.

Web: the Microsoft SQL docs troubleshooting page for Azure SQL Entra auth documents a real gotcha. When you run CREATE USER ... FROM EXTERNAL PROVIDER to add a managed identity or service principal as a database user, Azure SQL has to look the identity up in Microsoft Entra ID on your behalf. If your tenants Conditional Access policies block that lookup, the command fails with SQL error 33134 and the message blames access denied, missing MFA enrollment, or first-party app preauthorization. Docs: https://github.com/microsoftdocs/sql-docs/blob/HEAD/azure-sql/database/authentication-aad-configure.md