// roles/azure · databases

Cosmos DB OperatorAzure built-in role

Lets you manage Azure Cosmos DB accounts, but not access data in them. Prevents access to account keys and connection strings.

Role ID	`230815da-be43-4aae-9cb4-875f7bd000aa`
Category	Databases
Actions	8 (minus 30 NotActions)
Data actions	0

What it can do

Permission	What it allows
`Microsoft.DocumentDb/databaseAccounts/*`	Every operation under Microsoft.DocumentDb/databaseAccounts
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action`	Joins resource such as storage account or SQL database to a subnet. Not alertable.

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.DocumentDB/databaseAccounts/copyJobs/*`	Every operation under Microsoft.DocumentDB/databaseAccounts/copyJobs
`Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/*`	Every operation under Microsoft.DocumentDB/databaseAccounts/dataTransferJobs
`Microsoft.DocumentDB/databaseAccounts/readonlyKeys/*`	Every operation under Microsoft.DocumentDB/databaseAccounts/readonlyKeys
`Microsoft.DocumentDB/databaseAccounts/regenerateKey/*`	Every operation under Microsoft.DocumentDB/databaseAccounts/regenerateKey
`Microsoft.DocumentDB/databaseAccounts/listKeys/*`	Every operation under Microsoft.DocumentDB/databaseAccounts/listKeys
`Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/*`	Every operation under Microsoft.DocumentDB/databaseAccounts/listConnectionStrings
`Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write`	Create or update a SQL Role Definition
`Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete`	Delete a SQL Role Definition
`Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write`	Create or update a SQL Role Assignment
`Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete`	Delete a SQL Role Assignment
`Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write`	Create or update a Mongo Role Definition
`Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete`	Delete a MongoDB Role Definition
`Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write`	Create or update a MongoDB User Definition
`Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete`	Delete a MongoDB User Definition
`Microsoft.DocumentDB/databaseAccounts/tableRoleAssignments/write`
`Microsoft.DocumentDB/databaseAccounts/tableRoleAssignments/delete`
`Microsoft.DocumentDB/databaseAccounts/tableRoleDefinitions/write`
`Microsoft.DocumentDB/databaseAccounts/tableRoleDefinitions/delete`
`Microsoft.DocumentDB/databaseAccounts/gremlinRoleAssignments/write`
`Microsoft.DocumentDB/databaseAccounts/gremlinRoleAssignments/delete`
`Microsoft.DocumentDB/databaseAccounts/gremlinRoleDefinitions/write`
`Microsoft.DocumentDB/databaseAccounts/gremlinRoleDefinitions/delete`
`Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments/write`
`Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments/delete`
`Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions/write`
`Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions/delete`
`Microsoft.DocumentDB/databaseAccounts/mongoMIRoleAssignments/write`
`Microsoft.DocumentDB/databaseAccounts/mongoMIRoleAssignments/delete`
`Microsoft.DocumentDB/databaseAccounts/mongoMIRoleDefinitions/write`
`Microsoft.DocumentDB/databaseAccounts/mongoMIRoleDefinitions/delete`

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Cosmos DB Operator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Cosmos DB Operator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '230815da-be43-4aae-9cb4-875f7bd000aa')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "230815da-be43-4aae-9cb4-875f7bd000aa"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other databases roles

Azure Connected SQL Server Onboarding · 2 permissions
CosmosBackupOperator · 2 permissions
Semantic Reranker User · 2 permissions
CosmosRestoreOperator · 3 permissions
Cosmos DB Account Reader Role · 7 permissions
DocumentDB Account Contributor · 8 permissions
Redis Cache Contributor · 8 permissions
Azure Managed Redis Contributor · 9 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles