Use Contained Database Users in SQL Server

Last updated: August 28, 2026.

A contained database user authenticates at the database level and does not depend on a server login SID. It can simplify portability, but the server and client connection must support the model.

Enable and create a contained user

EXEC sys.sp_configure N'contained database authentication', 1;
RECONFIGURE;
ALTER DATABASE YourDatabase SET CONTAINMENT = PARTIAL;
GO
USE YourDatabase;
CREATE USER AppUser WITH PASSWORD = 'Use-a-secret-from-your-vault';
ALTER ROLE db_datareader ADD MEMBER AppUser;

Use least privilege

• Connect with an explicit database name.
• Grant only required database permissions.
• Keep passwords outside deployment scripts.
• Audit containment and authentication requirements before migration.

Reference: Microsoft contained database users guidance.