CREATE USER FROM EXTERNAL PROVIDER fails with SQL error 33134

error 33134 is not a SQL permission problem, its an Entra policy problem. Read the message inside the error. If it says access is denied or MFA enrollment is required, the cause is usually a Conditional Access policy blocking the lookup. The documented fix is to update the policy to allow access to the Microsoft Graph application, application ID 00000003-0000-0000-c000-000000000000. If the message says access between first-party applications must be handled via preauthorization, the cause is different: you ran the command while signed in as a service principal. Sign in as a regular user and run the same CREATE USER statement again and it succeeds. Always run the initial CREATE USER as a user, not a service principal.

Web: the Microsoft SQL docs troubleshooting page for Azure SQL Entra auth documents a real gotcha. When you run CREATE USER ... FROM EXTERNAL PROVIDER to add a managed identity or service principal as a database user, Azure SQL has to look the identity up in Microsoft Entra ID on your behalf. If your tenants Conditional Access policies block that lookup, the command fails with SQL error 33134 and the message blames access denied, missing MFA enrollment, or first-party app preauthorization. Docs: https://github.com/microsoftdocs/sql-docs/blob/HEAD/azure-sql/database/authentication-aad-configure.md