Azure Databases built-in role
DocumentDB Account Contributor
Broadly manages Azure Cosmos DB accounts and their child resources through the control plane. It has no DataActions, but its unrestricted account-management wildcard includes key and connection-string operations and management of native data-plane role definitions and assignments, so it is not a least-privilege default.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5bd9cd88-fe45-4216-938b-f97437e15450
Control-plane actions (8)
Microsoft.Authorization/*/readMicrosoft.DocumentDb/databaseAccounts/*Microsoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on an individual Cosmos DB account or a dedicated resource group only when the administrator owns the full account lifecycle. Parent assignments are inherited. Native item access is a separate data plane, but account-key retrieval can open a key-authenticated path outside Microsoft Entra data-role assignments.
Common use cases (2)
- Create, configure, move, update, or delete Azure Cosmos DB account resources and their child database or container resources.
- Perform trusted account administration that explicitly requires operations excluded from Cosmos DB Operator, such as account-key or native data-role administration.
Prerequisites (2)
- Confirm that full account lifecycle, key operations, or native data-role administration is required rather than the constrained Cosmos DB Operator role.
- Identify the individual account or dedicated resource-group boundary and separately plan application item permissions.
Best practices (3)
- Use Cosmos DB Operator when account management is required without account keys, connection strings, or native data-role writes.
- Prefer Microsoft Entra data-plane roles for applications and disable key-based authentication after dependent clients are migrated.
- Scope this broad role to one account or dedicated resource group and review assignments regularly.
Security considerations (3)
- The role can make destructive account and child-resource changes and can manage credentials and native data-role resources through its account wildcard.
- No DataActions are present, but retrieved account keys can authorize data access through the separate key-based path.
- Combining full control-plane administration with native data-role administration concentrates infrastructure and access-control authority.
Assignment guidance
Reserve DocumentDB Account Contributor for trusted account administrators or automation that requires the full account wildcard. Assign at the individual account or dedicated resource group, prefer Cosmos DB Operator for constrained operations, and grant application data access through native Cosmos DB roles.
Related roles (2)
- Cosmos DB Operator: Constrained account-management alternative that excludes keys, connection strings, transfer jobs, and native data-role writes or deletes.
- Cosmos DB Built-in Data Contributor: Native Azure Cosmos DB data-plane role for item and container operations, separate from account management.
Common questions
When should I assign the DocumentDB Account Contributor Azure role?
Assign DocumentDB Account Contributor when you need to: Create, configure, move, update, or delete Azure Cosmos DB account resources and their child database or container resources.; and Perform trusted account administration that explicitly requires operations excluded from Cosmos DB Operator, such as account-key or native data-role administration.. Practical scope: Assign on an individual Cosmos DB account or a dedicated resource group only when the administrator owns the full account lifecycle. Parent assignments are inherited. Native item access is a separate data plane, but account-key retrieval can open a key-authenticated path outside Microsoft Entra data-role assignments.
What permissions does the DocumentDB Account Contributor Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.DocumentDb/databaseAccounts/*; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the DocumentDB Account Contributor Azure role?
Key considerations when assigning DocumentDB Account Contributor: The role can make destructive account and child-resource changes and can manage credentials and native data-role resources through its account wildcard.; No DataActions are present, but retrieved account keys can authorize data access through the separate key-based path.; and Combining full control-plane administration with native data-role administration concentrates infrastructure and access-control authority.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (4)
- Azure built-in roles for Databases →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Connect to Azure Cosmos DB for NoSQL using role-based access control and Microsoft Entra ID →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.