A REST GET request to the order entity that includes the access token and x-MS-API-ROLE: operations will return data. → No

When DAB runs the stored procedure, the database policy defined on the FinalizeOrder entity will be enforced. → Yes

If the client omits the x-MS-API-ROLE header but still sends the same access token, the order entity read request will run in the authenticated role context. → Yes

The first statement is No . In Data API builder, when a valid token is sent with X-MS-API-ROLE, the request runs in that requested role if that role is present in the token . Here, that means the effective role becomes operations , not authenticated. But the order entity grants read only to the authenticated role, not to operations, so the GET request would not be authorized to return data.

The second statement is Yes . DAB evaluates the request against the permissions and policies configured for the effective role on the requested entity. The FinalizeOrder entity grants execute to role operations and includes a database policy of TenantId = @claims.tenantid, so that policy is part of the enforced authorization/filtering behavior when the stored procedure entity is executed.

The third statement is Yes . If the client sends a valid access token without X-MS-API-ROLE, DAB uses the built-in Authenticated system role by default. Since the order entity allows read for the authenticated role, that read request runs in the authenticated role context.

Top of Form

Bottom of Form