From 019a0ef918cb6d6494eb1ee8809dfa4d5d51720a Mon Sep 17 00:00:00 2001
From: "github-agentic-autofix[bot]"
 <314318003+GitHub Agentic Autofix@users.noreply.github.com>
Date: Thu, 12 Nov 2026 16:24:14 +0000
Subject: [PATCH 1/2] Initial plan


From e953c98f0fec8c513e213036aa02b3a039101daf Mon Sep 17 00:00:00 2001
From: "github-agentic-autofix[bot]"
 <314318003+GitHub Agentic Autofix@users.noreply.github.com>
Date: Thu, 12 Nov 2026 16:28:38 +0000
Subject: [PATCH 2/2] Use least-privilege SQL app credentials

Co-authored-by: mageroni <107436170+mageroni@users.noreply.github.com>
---
 README.md                 | 11 +++++++++++
 deployment/template.bicep |  6 +++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a4afafc..205c962 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,17 @@ The web server and SQL database are the minimum requirements for this app to wor
 
 You can use this link to deploy all resources automatically in your Azure subscription [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fmageroni%2Fcopilot-survey-engine%2Fmain%2Fdeployment%2Ftemplate.json)
 
+For deployments using `deployment/template.bicep`, configure the app's SQL credentials separately from the SQL server administrator credentials. Before starting the app, create a contained database user named `copilotSurveyApp` in the `copilotUsage` database using the password supplied as `sqlApplicationLoginPassword`. Grant that user only the permissions needed by the app:
+
+```sql
+CREATE USER [copilotSurveyApp] WITH PASSWORD = '<application-password>';
+GRANT CREATE TABLE TO [copilotSurveyApp];
+GRANT ALTER ON SCHEMA::dbo TO [copilotSurveyApp];
+GRANT SELECT, INSERT, UPDATE ON SCHEMA::dbo TO [copilotSurveyApp];
+```
+
+The app creates `SurveyResults` on first use and then reads and writes survey responses. Do not use the SQL server administrator credentials for the app connection.
+
 ### Step 2. Execute locally and configure secrets
 
 To run the application on you local machine you'll need to have installed NodeJS. Once you have it, you can access to the folder where you've cloned this project and run the following:
diff --git a/deployment/template.bicep b/deployment/template.bicep
index 016c5dc..61193ab 100644
--- a/deployment/template.bicep
+++ b/deployment/template.bicep
@@ -17,6 +17,10 @@ param sqlAdministratorLogin string
 @secure()
 param sqlAdministratorLoginPassword string
 
+@description('Password for the application-specific Azure SQL database user')
+@secure()
+param sqlApplicationLoginPassword string
+
 @description('application insights name')
 param appInsightsName string
 
@@ -310,7 +314,7 @@ resource appService 'Microsoft.Web/sites@2022-09-01' = {
         }
         {
           name: 'DATABASE_CONNECTION_STRING'
-          value: 'Server=tcp:${sqlServer.name}${environment().suffixes.sqlServerHostname},1433;Initial Catalog=copilotUsage;Persist Security Info=False;User ID=${sqlAdministratorLogin};Password=${sqlAdministratorLoginPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;'
+          value: 'Server=tcp:${sqlServer.name}${environment().suffixes.sqlServerHostname},1433;Initial Catalog=copilotUsage;Persist Security Info=False;User ID=copilotSurveyApp;Password=${sqlApplicationLoginPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;'
         }
         {
           name: 'LANGUAGE_API_ENDPOINT'