[github-agentic-autofix]

The app’s database connection used the SQL server administrator login, giving a compromised app broader privileges than needed.

• Deployment: Use the contained copilotSurveyApp database user and a separate secure sqlApplicationLoginPassword parameter.

• Provisioning: Document the minimum database permissions required by the app:

  CREATE USER [copilotSurveyApp] WITH PASSWORD = '<application-password>';
  GRANT CREATE TABLE TO [copilotSurveyApp];
  GRANT ALTER ON SCHEMA::dbo TO [copilotSurveyApp];
  GRANT SELECT, INSERT, UPDATE ON SCHEMA::dbo TO [copilotSurveyApp];

[Copilot]

🟡 Changes recommended

The README’s SQL provisioning guidance leaves excessive permissions on the runtime identity and omits application-user setup and database-access instructions needed across both deployment paths.

2 open issues

• Omit database user setup for the template deployment path · New
• Retain excessive SQL schema permissions on the runtime identity · New

What changed in this PR

This PR separates the Bicep-deployed app’s Azure SQL credentials from the server administrator account, reducing the app’s database privileges.

Changes:

• Adds a secure application-password parameter and switches the connection string to copilotSurveyApp.
• Documents manual user provisioning and permissions for table creation and survey reads/writes.

File	Description
README.md	Documents the contained database user and required permissions.
deployment/​template.bicep	Adds separate application credentials and replaces administrator credentials in the app connection string.

_{Review effort: Max (auto)}