Azure Databases built-in role

Cosmos DB Operator

Broadly manages Azure Cosmos DB accounts through the Azure control plane while excluding account keys, connection strings, copy and data-transfer jobs, and writes or deletes for native data-plane role definitions and assignments. It has no DataActions and does not authorize item access.

Control-plane actions (8)

• Microsoft.DocumentDb/databaseAccounts/*
• Microsoft.Insights/alertRules/*
• Microsoft.Authorization/*/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (30)

• Microsoft.DocumentDB/databaseAccounts/copyJobs/*
• Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/*
• Microsoft.DocumentDB/databaseAccounts/readonlyKeys/*
• Microsoft.DocumentDB/databaseAccounts/regenerateKey/*
• Microsoft.DocumentDB/databaseAccounts/listKeys/*
• Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/*
• Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete
• Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write
• Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete
• Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete
• Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete
• Microsoft.DocumentDB/databaseAccounts/tableRoleAssignments/write
• Microsoft.DocumentDB/databaseAccounts/tableRoleAssignments/delete
• Microsoft.DocumentDB/databaseAccounts/tableRoleDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/tableRoleDefinitions/delete
• Microsoft.DocumentDB/databaseAccounts/gremlinRoleAssignments/write
• Microsoft.DocumentDB/databaseAccounts/gremlinRoleAssignments/delete
• Microsoft.DocumentDB/databaseAccounts/gremlinRoleDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/gremlinRoleDefinitions/delete
• Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments/write
• Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments/delete
• Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions/delete
• Microsoft.DocumentDB/databaseAccounts/mongoMIRoleAssignments/write
• Microsoft.DocumentDB/databaseAccounts/mongoMIRoleAssignments/delete
• Microsoft.DocumentDB/databaseAccounts/mongoMIRoleDefinitions/write
• Microsoft.DocumentDB/databaseAccounts/mongoMIRoleDefinitions/delete

Assignable scopes (1)

• /

Practical scope

Assign on an individual Cosmos DB account or a dedicated resource group containing accounts the operator owns. Parent-scope assignments are inherited. The role controls account resources but does not grant native Cosmos DB data-plane access or Azure RBAC role-assignment authority.

Common use cases (2)

• Operate Azure Cosmos DB account resources and configuration without exposing account keys or connection strings.
• Deploy and manage account infrastructure while keeping application item access and native data-role administration with separate identities.

Prerequisites (2)

• Identify the account lifecycle and configuration operations the operator must perform and verify that key operations, data-transfer jobs, and native data-role administration are not required.
• Assign native Cosmos DB data-plane roles separately to applications or users that query or modify items.

Best practices (3)

• Use this role instead of DocumentDB Account Contributor when broad account management is required but account-key and connection-string access is not.
• Scope to an individual account or dedicated resource group and separate account operations from application data access.
• Use a custom role if the operator needs fewer account-management operations than this broad built-in role grants.

Security considerations (3)

• The role can make broad control-plane changes to accounts, databases, containers, throughput, networking, and deployments even though it cannot read items through DataActions.
• Its exclusions prevent account-key and connection-string retrieval and prevent writes or deletes to native Cosmos DB role definitions and assignments.
• It remains a broad contributor-style role and is not a least-privilege default for a narrow operational task.

Assignment guidance

Assign Cosmos DB Operator to the trusted account-operations identity at the individual account or dedicated resource-group scope. Keep native data roles and their administration separate, and use DocumentDB Account Contributor only when excluded key or account operations are explicitly required.

Related roles (2)

• DocumentDB Account Contributor: Broader account-management role without the Operator exclusions for account keys, connection strings, and native data-role administration.
• Cosmos DB Account Reader Role: Read-oriented management role for account metadata and read-only keys when account changes are unnecessary.

Editorial sources (4)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Connect to Azure Cosmos DB for NoSQL using role-based access control and Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →