// roles/azure · databases

SQL Server ContributorAzure built-in role

Lets you manage SQL servers and databases, but not access to them, and not their security -related policies.

Role ID	`6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437`
Category	Databases
Actions	10 (minus 30 NotActions)
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Sql/locations/*/read`	Any read operation on anything under Microsoft.Sql/locations
`Microsoft.Sql/servers/*`	Every operation under Microsoft.Sql/servers
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Insights/metrics/read`	Read metrics
`Microsoft.Insights/metricDefinitions/read`	Read metric definitions

Can't do

These are taken away from the actions above.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "SQL Server Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "SQL Server Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other databases roles

Azure Connected SQL Server Onboarding · 2 permissions
CosmosBackupOperator · 2 permissions
Semantic Reranker User · 2 permissions
CosmosRestoreOperator · 3 permissions
Cosmos DB Account Reader Role · 7 permissions
Cosmos DB Operator · 8 permissions
DocumentDB Account Contributor · 8 permissions
Redis Cache Contributor · 8 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles

Permission	What it allows
`Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/currentSensitivityLabels
`Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels
`Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels
`Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*`	Every operation under Microsoft.Sql/managedInstances/databases/securityAlertPolicies
`Microsoft.Sql/managedInstances/databases/sensitivityLabels/*`	Every operation under Microsoft.Sql/managedInstances/databases/sensitivityLabels
`Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments
`Microsoft.Sql/managedInstances/securityAlertPolicies/*`	Every operation under Microsoft.Sql/managedInstances/securityAlertPolicies
`Microsoft.Sql/managedInstances/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/managedInstances/vulnerabilityAssessments
`Microsoft.Sql/servers/auditingSettings/*`	Every operation under Microsoft.Sql/servers/auditingSettings
`Microsoft.Sql/servers/databases/auditingSettings/*`	Every operation under Microsoft.Sql/servers/databases/auditingSettings
`Microsoft.Sql/servers/databases/auditRecords/read`	Retrieve the database blob audit records
`Microsoft.Sql/servers/databases/currentSensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/currentSensitivityLabels
`Microsoft.Sql/servers/databases/dataMaskingPolicies/*`	Every operation under Microsoft.Sql/servers/databases/dataMaskingPolicies
`Microsoft.Sql/servers/databases/extendedAuditingSettings/*`	Every operation under Microsoft.Sql/servers/databases/extendedAuditingSettings
`Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/recommendedSensitivityLabels
`Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels
`Microsoft.Sql/servers/databases/securityAlertPolicies/*`	Every operation under Microsoft.Sql/servers/databases/securityAlertPolicies
`Microsoft.Sql/servers/databases/securityMetrics/*`	Every operation under Microsoft.Sql/servers/databases/securityMetrics
`Microsoft.Sql/servers/databases/sensitivityLabels/*`	Every operation under Microsoft.Sql/servers/databases/sensitivityLabels
`Microsoft.Sql/servers/databases/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessments
`Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans
`Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*`	Every operation under Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings
`Microsoft.Sql/servers/devOpsAuditingSettings/*`	Every operation under Microsoft.Sql/servers/devOpsAuditingSettings
`Microsoft.Sql/servers/extendedAuditingSettings/*`	Every operation under Microsoft.Sql/servers/extendedAuditingSettings
`Microsoft.Sql/servers/securityAlertPolicies/*`	Every operation under Microsoft.Sql/servers/securityAlertPolicies
`Microsoft.Sql/servers/vulnerabilityAssessments/*`	Every operation under Microsoft.Sql/servers/vulnerabilityAssessments
`Microsoft.Sql/servers/azureADOnlyAuthentications/delete`	Deletes a specific server Azure Active Directory only authentication object
`Microsoft.Sql/servers/azureADOnlyAuthentications/write`	Adds or updates a specific server Azure Active Directory only authentication object
`Microsoft.Sql/servers/externalPolicyBasedAuthorizations/delete`	Deletes a specific server external policy based authorization property
`Microsoft.Sql/servers/externalPolicyBasedAuthorizations/write`	Adds or updates a specific server external policy based authorization property