Azure SQL Database: Validating logical_database_guid as a stable identifier for least-privilege access — Permissions and best practices

Hello @Ramu-1383

Yes, logical_database_guid is the appropriate database-local identifier for this scenario. It is a unique identifier that remains unchanged throughout the lifetime of the user database. Renaming the database or changing its service-level objective doesn’t change the value.

Use sys.dm_user_db_resource_governance, not sys.database_service_objectives:

SELECT logical_database_guid
FROM sys.dm_user_db_resource_governance
WHERE database_id = DB_ID();

For a standalone General Purpose Azure SQL Database, VIEW DATABASE STATE is the required database-level permission:

GRANT VIEW DATABASE STATE TO [collector_user];

This works for either a contained SQL user or contained Microsoft Entra principal, provided the permission is granted in the target database. sys.dm_user_db_resource_governance permissions.

If granting VIEW DATABASE STATE directly exposes more database-state information than the collector requires, use a stored procedure executed under a dedicated, non-login database user:

CREATE USER [DbGuidReader] WITHOUT LOGIN;
GRANT VIEW DATABASE STATE TO [DbGuidReader];
GO
CREATE OR ALTER PROCEDURE dbo.GetLogicalDatabaseGuid
WITH EXECUTE AS 'DbGuidReader'
AS
BEGIN
    SET NOCOUNT ON;
    SELECT logical_database_guid
    FROM sys.dm_user_db_resource_governance
    WHERE database_id = DB_ID();
END;
GO
GRANT EXECUTE ON OBJECT::dbo.GetLogicalDatabaseGuid
TO [collector_user];

A user created with WITHOUT LOGIN can hold permissions and be used as an execution context. EXECUTE AS allows callers to receive permission only on the module while referenced-object permissions are evaluated against the designated execution principal.

I recommend the dedicated DbGuidReader principal instead of EXECUTE AS OWNER. Use the least-privileged execution principal and not the database owner unless owner-level permissions are required.

References:

sys.dm_user_db_resource_governance (Transact-SQL)

EXECUTE AS clause (Transact-SQL)

CREATE USER (Transact-SQL)

GRANT database permissions (Transact-SQL)

Microsoft Entra service principals with Azure SQL

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.