error 33134 is not a SQL permission problem, its an Entra policy problem. Read the message inside the error. If it says access is denied or MFA enrollment is required, the cause is usually a Conditional Access policy blocking the lookup. The documented fix is to update the policy to allow access to the Microsoft Graph application, application ID 00000003-0000-0000-c000-000000000000. If the message says access between first-party applications must be handled via preauthorization, the cause is different: you ran the command while signed in as a service principal. Sign in as a regular user and run the same CREATE USER statement again and it succeeds. Always run the initial CREATE USER as a user, not a service principal.