Azure Databases built-in role
CosmosRestoreOperator
Reads restorable Azure Cosmos DB accounts and submits point-in-time restore requests for accounts that use continuous backup. It is a restore control-plane role with no DataActions; creating the restored account requires separate write permission on the destination resource group.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5432c526-bc82-444a-b7ba-57c5b0b5b34f
Control-plane actions (3)
Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/actionMicrosoft.DocumentDB/locations/restorableDatabaseAccounts/*/readMicrosoft.DocumentDB/locations/restorableDatabaseAccounts/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the source restorable database account when possible or at its subscription when the principal must restore multiple accounts. Microsoft states that resource-group scope is not supported for the source restore permission. Grant the destination account write permission separately on the target resource group.
Common use cases (2)
- Discover restorable accounts and restore a live or deleted account, database, or container from continuous backup to a new account.
- Delegate point-in-time recovery while keeping ordinary account management and item access separate.
Prerequisites (3)
- The source account must use continuous backup and have a valid restorable point, region, and resource selection.
- The destination resource group must already exist, and the principal needs Cosmos DB Operator or equivalent Microsoft.DocumentDB/databaseAccounts/write permission there.
- Template-based restores also require the documented deployment validation and write permissions.
Best practices (3)
- Assign the source restore role at the individual restorable account when the workflow supports that granularity and grant destination write access only on the approved resource group.
- Identify the latest restorable timestamp before restoring a live account and validate the target name, region, selected resources, and one-time restore cost.
- Review and recreate settings that point-in-time restore does not carry forward, including firewall, virtual network, private endpoint, and data-plane role assignments.
Security considerations (3)
- A restore materializes historical account data into a new account and can expose that data through the target account configuration and destination permissions.
- The role has no DataActions, but restore authority is data-recovery authority and should be treated as privileged.
- Deleting the source account during restore can cause failure, and restored security and network settings require separate review.
Assignment guidance
Assign CosmosRestoreOperator to the recovery identity on the source restorable account or, only when required, the source subscription. Assign Cosmos DB Operator or equivalent account-write permission separately on the destination resource group, then remove temporary restore access after recovery validation.
Related roles (1)
- Cosmos DB Operator: Microsoft documents Cosmos DB Operator on the destination resource group to provide the account write permission required alongside CosmosRestoreOperator.
Common questions
When should I assign the CosmosRestoreOperator Azure role?
Assign CosmosRestoreOperator when you need to: Discover restorable accounts and restore a live or deleted account, database, or container from continuous backup to a new account.; and Delegate point-in-time recovery while keeping ordinary account management and item access separate.. Practical scope: Assign at the source restorable database account when possible or at its subscription when the principal must restore multiple accounts. Microsoft states that resource-group scope is not supported for the source restore permission. Grant the destination account write permission separately on the target resource group.
What permissions does the CosmosRestoreOperator Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/action; Microsoft.DocumentDB/locations/restorableDatabaseAccounts/*/read; and Microsoft.DocumentDB/locations/restorableDatabaseAccounts/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the CosmosRestoreOperator Azure role?
Key considerations when assigning CosmosRestoreOperator: A restore materializes historical account data into a new account and can expose that data through the target account configuration and destination permissions.; The role has no DataActions, but restore authority is data-recovery authority and should be treated as privileged.; and Deleting the source account during restore can cause failure, and restored security and network settings require separate review.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Databases →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Manage permissions to restore an Azure Cosmos DB account →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Restore an Azure Cosmos DB account that uses continuous backup mode →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.