// roles/azure · databases

SQL Managed Instance ContributorAzure built-in role

Lets you manage SQL Managed Instances and required network configuration, but can't give access to others.

Role ID	`4939a1f6-9ae0-4e48-a1e0-f2cbe897382d`
Category	Databases
Actions	15 (minus 2 NotActions)
Data actions	0

What it can do

Permission	What it allows
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Network/networkSecurityGroups/*`	Every operation under Microsoft.Network/networkSecurityGroups
`Microsoft.Network/routeTables/*`	Every operation under Microsoft.Network/routeTables
`Microsoft.Sql/locations/*/read`	Any read operation on anything under Microsoft.Sql/locations
`Microsoft.Sql/locations/instanceFailoverGroups/*`	Every operation under Microsoft.Sql/locations/instanceFailoverGroups
`Microsoft.Sql/managedInstances/*`	Every operation under Microsoft.Sql/managedInstances
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Network/virtualNetworks/subnets/*`	Every operation under Microsoft.Network/virtualNetworks/subnets
`Microsoft.Network/virtualNetworks/*`	Every operation under Microsoft.Network/virtualNetworks
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Insights/metrics/read`	Read metrics
`Microsoft.Insights/metricDefinitions/read`	Read metric definitions

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.Sql/managedInstances/azureADOnlyAuthentications/delete`	Deletes a specific managed server Azure Active Directory only authentication object
`Microsoft.Sql/managedInstances/azureADOnlyAuthentications/write`	Adds or updates a specific managed server Azure Active Directory only authentication object

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "SQL Managed Instance Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "SQL Managed Instance Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '4939a1f6-9ae0-4e48-a1e0-f2cbe897382d')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4939a1f6-9ae0-4e48-a1e0-f2cbe897382d')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "4939a1f6-9ae0-4e48-a1e0-f2cbe897382d"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other databases roles

Azure Connected SQL Server Onboarding · 2 permissions
CosmosBackupOperator · 2 permissions
Semantic Reranker User · 2 permissions
CosmosRestoreOperator · 3 permissions
Cosmos DB Account Reader Role · 7 permissions
Cosmos DB Operator · 8 permissions
DocumentDB Account Contributor · 8 permissions
Redis Cache Contributor · 8 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles