AAD in Azure sql with multi groups within the single database

Question

The idea is to use aad group as admin and then create a aad group in azure database as showed
"CREATE USER [aad-group] FROM EXTERNAL PROVIDER"

Afterward remove the aad group as admin and use the aad group i added above to login.
It seems that when i do it my sql server gets rolled back and the ad group does not exist

The point is to have my client add new member into the aad group and give them access to the database/table within the azure sql

Answer 1

Sorry to say that, but "this is not how it works" ;-)

That user "Azure Active Directory Admin" is "only" used to connect to your AAD to read/check your AAD; without that user the SQL Server won't be able to connect to your AAD, so it won't be able to link any AAD-User or group to your SQL Server.

for example, you create a user for those tasks like yourdomain\svc.sqlserveraad that user has read access to your AAD, and you configure your SQL Server to use this user as "Azure Active Directory Admin." You create/link that customer-admin-group in your database and grant them their permissions.