// roles/azure · databases

SQL Security ManagerAzure built-in role

Lets you manage the security-related policies of SQL servers and databases, but not access to them.

Role ID	`056cd41c-7e88-42e1-933e-88ba6a50c9c3`
Category	Databases
Actions	65
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action`	Joins resource such as storage account or SQL database to a subnet. Not alertable.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Sql/locations/administratorAzureAsyncOperation/read`	Gets the Managed instance azure async administrator operations result.
`Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read`	Retrieve a list of managed instance Advanced Threat Protection settings configured for a given instance
`Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write`	Change the managed instance Advanced Threat Protection settings for a given managed instance
`Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read`	Retrieve a list of the managed database Advanced Threat Protection settings configured for a given managed database
`Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write`	Change the database Advanced Threat Protection settings for a given managed database
`Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/currentSensitivityLabels
`Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels
`Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels
`Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*`	Every operation under Microsoft.Sql/managedInstances/databases/securityAlertPolicies
`Microsoft.Sql/managedInstances/databases/sensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/sensitivityLabels
`Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments
`Microsoft.Sql/servers/advancedThreatProtectionSettings/read`	Retrieve a list of server Advanced Threat Protection settings configured for a given server
`Microsoft.Sql/servers/advancedThreatProtectionSettings/write`	Change the server Advanced Threat Protection settings for a given server
`Microsoft.Sql/managedInstances/securityAlertPolicies/*`	Every operation under Microsoft.Sql/managedInstances/securityAlertPolicies
`Microsoft.Sql/managedInstances/databases/transparentDataEncryption/*`	Every operation under Microsoft.Sql/managedInstances/databases/transparentDataEncryption
`Microsoft.Sql/managedInstances/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/managedInstances/vulnerabilityAssessments
`Microsoft.Sql/managedInstances/serverConfigurationOptions/read`	Gets properties for the specified Azure SQL Managed Instance Server Configuration Option.
`Microsoft.Sql/managedInstances/serverConfigurationOptions/write`	Updates Azure SQL Managed Instance's Server Configuration Option properties for the specified instance.
`Microsoft.Sql/locations/serverConfigurationOptionAzureAsyncOperation/read`	Gets the status of Azure SQL Managed Instance Server Configuration Option Azure async operation.
`Microsoft.Sql/servers/auditingSettings/*`	Every operation under Microsoft.Sql/servers/auditingSettings
`Microsoft.Sql/servers/extendedAuditingSettings/*`	Every operation under Microsoft.Sql/servers/extendedAuditingSettings
`Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read`	Retrieve a list of database Advanced Threat Protection settings configured for a given database
`Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write`	Change the database Advanced Threat Protection settings for a given database
`Microsoft.Sql/servers/databases/auditingSettings/*`	Every operation under Microsoft.Sql/servers/databases/auditingSettings
`Microsoft.Sql/servers/databases/auditRecords/read`	Retrieve the database blob audit records
`Microsoft.Sql/servers/databases/currentSensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/currentSensitivityLabels
`Microsoft.Sql/servers/databases/dataMaskingPolicies/*`	Every operation under Microsoft.Sql/servers/databases/dataMaskingPolicies
`Microsoft.Sql/servers/databases/extendedAuditingSettings/read`	Retrieve details of the extended blob auditing policy configured on a given database
`Microsoft.Sql/servers/databases/read`	Return the list of databases or gets the properties for the specified database.
`Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/recommendedSensitivityLabels
`Microsoft.Sql/servers/databases/schemas/read`	Get a database schema.
`Microsoft.Sql/servers/databases/schemas/tables/columns/read`	Get a database column.
`Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels
`Microsoft.Sql/servers/databases/schemas/tables/read`	Get a database table.
`Microsoft.Sql/servers/databases/securityAlertPolicies/*`	Every operation under Microsoft.Sql/servers/databases/securityAlertPolicies
`Microsoft.Sql/servers/databases/securityMetrics/*`	Every operation under Microsoft.Sql/servers/databases/securityMetrics
`Microsoft.Sql/servers/databases/sensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/sensitivityLabels
`Microsoft.Sql/servers/databases/transparentDataEncryption/*`	Every operation under Microsoft.Sql/servers/databases/transparentDataEncryption
`Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments
`Microsoft.Sql/servers/databases/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessments
`Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans
`Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings
`Microsoft.Sql/servers/devOpsAuditingSettings/*`	Every operation under Microsoft.Sql/servers/devOpsAuditingSettings
`Microsoft.Sql/servers/firewallRules/*`	Every operation under Microsoft.Sql/servers/firewallRules
`Microsoft.Sql/servers/read`	Return the list of servers or gets the properties for the specified server.
`Microsoft.Sql/servers/securityAlertPolicies/*`	Every operation under Microsoft.Sql/servers/securityAlertPolicies
`Microsoft.Sql/servers/sqlvulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/sqlvulnerabilityAssessments
`Microsoft.Sql/servers/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/vulnerabilityAssessments
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Sql/servers/azureADOnlyAuthentications/*`	Every operation under Microsoft.Sql/servers/azureADOnlyAuthentications
`Microsoft.Sql/managedInstances/read`	Return the list of managed instances or gets the properties for the specified managed instance.
`Microsoft.Sql/managedInstances/azureADOnlyAuthentications/*`	Every operation under Microsoft.Sql/managedInstances/azureADOnlyAuthentications
`Microsoft.Security/sqlVulnerabilityAssessments/*`	Every operation under Microsoft.Security/sqlVulnerabilityAssessments
`Microsoft.Sql/managedInstances/administrators/read`	Gets a list of managed instance administrators.
`Microsoft.Sql/servers/administrators/read`	Gets a specific Azure Active Directory administrator object
`Microsoft.Sql/servers/databases/ledgerDigestUploads/*`	Every operation under Microsoft.Sql/servers/databases/ledgerDigestUploads
`Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read`	Gets in-progress operations of ledger digest upload settings
`Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read`	Gets in-progress operations of ledger digest upload settings
`Microsoft.Sql/servers/externalPolicyBasedAuthorizations/*`	Every operation under Microsoft.Sql/servers/externalPolicyBasedAuthorizations

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "SQL Security Manager" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "SQL Security Manager" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '056cd41c-7e88-42e1-933e-88ba6a50c9c3')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '056cd41c-7e88-42e1-933e-88ba6a50c9c3')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "056cd41c-7e88-42e1-933e-88ba6a50c9c3"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other databases roles

Azure Connected SQL Server Onboarding · 2 permissions
CosmosBackupOperator · 2 permissions
Semantic Reranker User · 2 permissions
CosmosRestoreOperator · 3 permissions
Cosmos DB Account Reader Role · 7 permissions
Cosmos DB Operator · 8 permissions
DocumentDB Account Contributor · 8 permissions
Redis Cache Contributor · 8 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles