Using SQL permissions in Azure

Question

I am trying to use sql security in Azure and my first attempt doesn't work because the ALTER ROLE statement doesn't seem to be supported.  I'm interested in whether I can use sql security in Azure, and if so how.
My current approach, which works in SQL Server 2012, is to create roles and add users to those roles, e.g.
1. CREATE USER [xxx] FOR LOGIN [Azurexxx] WITH DEFAULT_SCHEMA=[dbo]
2. CREATE ROLE [AttendeeNoPayUpdate]
3. DENY UPDATE ON OBJECT::dbo.Attendees(HasPaid) TO [AttendeeNoPayUpdate]
4. ALTER ROLE [AttendeeNoPayUpdate] ADD MEMBER [xxx]
The first three statements work, but the ALTER ROLE does not, with the error 'Statement 'ADD/DROP ROLE MEMBER' is not supported in this version of SQL Server.'
My question is - how should I set up sql security on an Azure database? Clearly roles are supported, otherwise statements 2 and 3 wouldn't work, so can I use them with Users? Obviously the alternative is to stop using roles and assign  the GRANT/DENY
directly to the user, which looks like it works.(I use roles because I have the same permissions applied to lots of users).
I would appreciate any suggestions or insights on the best/correct way to set up GRANT/DENY permissions for users.
Jon Smith

Answer 1

Hi,
I found the answer after trawling a lot of sites. I found the page
Managing Databases and Logins in Azure SQL Database and Azure uses the stored procedure 'sp_addrolemember'. Once I swapped to that then everything worked.
In case someone else finds this useful I have listed the same code as in the question, but with the right command to add the role.
1. CREATE USER [xxx] FOR LOGIN [Azurexxx] WITH DEFAULT_SCHEMA=[dbo]
2. CREATE ROLE [AttendeeNoPayUpdate]
3. DENY UPDATE ON OBJECT::dbo.Attendees(HasPaid) TO [AttendeeNoPayUpdate]
4. EXEC sp_addrolemember 'AttendeeNoPayUpdate', 'xxx'
Jon Smith