The default permission for any SQL Login added at the time a database is provisioned through the SQL Resource Provider for Azure Stack is DBO.

This is not permittable for enterprises subject to regulatory compliance requirements to ensure least rights applicable are deployed (SOX compliance, PCI, etc.)

Allowing the permissions to be customizable at the SKU level allows the SQL Resource Provider operator to accommodate more restrictive default permission deployment requirements for servers offered through the resource provider.