Azure Databases built-in role

DocumentDB Account Contributor

Broadly manages Azure Cosmos DB accounts and their child resources through the control plane. It has no DataActions, but its unrestricted account-management wildcard includes key and connection-string operations and management of native data-plane role definitions and assignments, so it is not a least-privilege default.

Control-plane actions (8)

• Microsoft.Authorization/*/read
• Microsoft.DocumentDb/databaseAccounts/*
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on an individual Cosmos DB account or a dedicated resource group only when the administrator owns the full account lifecycle. Parent assignments are inherited. Native item access is a separate data plane, but account-key retrieval can open a key-authenticated path outside Microsoft Entra data-role assignments.

Common use cases (2)

• Create, configure, move, update, or delete Azure Cosmos DB account resources and their child database or container resources.
• Perform trusted account administration that explicitly requires operations excluded from Cosmos DB Operator, such as account-key or native data-role administration.

Prerequisites (2)

• Confirm that full account lifecycle, key operations, or native data-role administration is required rather than the constrained Cosmos DB Operator role.
• Identify the individual account or dedicated resource-group boundary and separately plan application item permissions.

Best practices (3)

• Use Cosmos DB Operator when account management is required without account keys, connection strings, or native data-role writes.
• Prefer Microsoft Entra data-plane roles for applications and disable key-based authentication after dependent clients are migrated.
• Scope this broad role to one account or dedicated resource group and review assignments regularly.

Security considerations (3)

• The role can make destructive account and child-resource changes and can manage credentials and native data-role resources through its account wildcard.
• No DataActions are present, but retrieved account keys can authorize data access through the separate key-based path.
• Combining full control-plane administration with native data-role administration concentrates infrastructure and access-control authority.

Assignment guidance

Reserve DocumentDB Account Contributor for trusted account administrators or automation that requires the full account wildcard. Assign at the individual account or dedicated resource group, prefer Cosmos DB Operator for constrained operations, and grant application data access through native Cosmos DB roles.

Related roles (2)

• Cosmos DB Operator: Constrained account-management alternative that excludes keys, connection strings, transfer jobs, and native data-role writes or deletes.
• Cosmos DB Built-in Data Contributor: Native Azure Cosmos DB data-plane role for item and container operations, separate from account management.

Editorial sources (4)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Connect to Azure Cosmos DB for NoSQL using role-based access control and Microsoft Entra ID →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →