Error on Create User - Server identity does not have Azure Active Directory Readers permission.

An orphaned user is a database user whose corresponding server login is missing or mismatched. You can't create a new user for the login because, as far as the database is concerned, a user for that login already exists it's just broken.

The solution is not to CREATE a new user, but to re-link the existing user to the server login.

1. Find the Existing User Name

First, run this query on the specific database to see if a user already exists that should be linked to your login.

SQL

SELECT
    name AS DatabaseUserName,
    sid AS UserSID
FROM sys.database_principals
WHERE type_desc IN ('SQL_USER', 'WINDOWS_USER', 'WINDOWS_GROUP')
  AND authentication_type_desc != 'NONE'; -- Exclude roles and schema-only users

Look for a user name in the results that should correspond to your server login.

2. Re-link the User to the Login

Once you've identified the existing database user name (e.g., SomeUser), run the following command to fix the mapping. This is the modern and preferred method.

SQL

-- Syntax: ALTER USER [database_user_name] WITH LOGIN = [server_login_name];
ALTER USER [SomeUser] WITH LOGIN = [YourLoginName];

This command updates the security identifier (SID) of the database user to match the SID of the server login, fixing the broken link. After running this, your login should work correctly without needing to create a new user.

If the above doesn't work, here are other things to check:

Incorrect Syntax: Double-check that your command is correct. The FROM LOGIN clause is required to link the new user to an existing server login.

SQL

CREATE USER [SomeUser] FROM LOGIN [YourLoginName];

Insufficient Permissions: To create or alter a user, you need the ALTER ANY USER permission or membership in the db_owner or db_accessadmin database roles.

To get to the right solution, the best next step is for you to share the exact error message you're seeing.