// roles/azure · databases

SQL DB ContributorAzure built-in role

Lets you manage SQL databases, but not access to them. Also, you can't manage their security-related policies or their parent SQL servers.

Role ID	`9b7fa17d-e63e-47b0-bb0a-15c516ac86ec`
Category	Databases
Actions	11 (minus 24 NotActions)
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Sql/locations/*/read`	Any read operation on anything under Microsoft.Sql/locations
`Microsoft.Sql/servers/databases/*`	Every operation under Microsoft.Sql/servers/databases
`Microsoft.Sql/servers/read`	Return the list of servers or gets the properties for the specified server.
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Insights/metrics/read`	Read metrics
`Microsoft.Insights/metricDefinitions/read`	Read metric definitions

Can't do

These are taken away from the actions above.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "SQL DB Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "SQL DB Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "9b7fa17d-e63e-47b0-bb0a-15c516ac86ec"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other databases roles

Azure Connected SQL Server Onboarding · 2 permissions
CosmosBackupOperator · 2 permissions
Semantic Reranker User · 2 permissions
CosmosRestoreOperator · 3 permissions
Cosmos DB Account Reader Role · 7 permissions
Cosmos DB Operator · 8 permissions
DocumentDB Account Contributor · 8 permissions
Redis Cache Contributor · 8 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles

Permission	What it allows
`Microsoft.Sql/servers/databases/ledgerDigestUploads/write`	Enable uploading ledger digests
`Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action`	Disable uploading ledger digests
`Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/currentSensitivityLabels
`Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels
`Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels
`Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*`	Every operation under Microsoft.Sql/managedInstances/databases/securityAlertPolicies
`Microsoft.Sql/managedInstances/databases/sensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/sensitivityLabels
`Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments
`Microsoft.Sql/managedInstances/securityAlertPolicies/*`	Every operation under Microsoft.Sql/managedInstances/securityAlertPolicies
`Microsoft.Sql/managedInstances/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/managedInstances/vulnerabilityAssessments
`Microsoft.Sql/servers/databases/auditingSettings/*`	Every operation under Microsoft.Sql/servers/databases/auditingSettings
`Microsoft.Sql/servers/databases/auditRecords/read`	Retrieve the database blob audit records
`Microsoft.Sql/servers/databases/currentSensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/currentSensitivityLabels
`Microsoft.Sql/servers/databases/dataMaskingPolicies/*`	Every operation under Microsoft.Sql/servers/databases/dataMaskingPolicies
`Microsoft.Sql/servers/databases/extendedAuditingSettings/*`	Every operation under Microsoft.Sql/servers/databases/extendedAuditingSettings
`Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/recommendedSensitivityLabels
`Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels
`Microsoft.Sql/servers/databases/securityAlertPolicies/*`	Every operation under Microsoft.Sql/servers/databases/securityAlertPolicies
`Microsoft.Sql/servers/databases/securityMetrics/*`	Every operation under Microsoft.Sql/servers/databases/securityMetrics
`Microsoft.Sql/servers/databases/sensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/sensitivityLabels
`Microsoft.Sql/servers/databases/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessments
`Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans
`Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings
`Microsoft.Sql/servers/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/vulnerabilityAssessments