Azure Databases built-in role

SQL DB Contributor

Broadly manages Azure SQL databases within existing logical servers but does not manage their parent servers, their security-related policies, or database data access. Its permissions are control-plane Actions only and contain no DataActions.

Control-plane actions (11)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Sql/locations/*/read
• Microsoft.Sql/servers/databases/*
• Microsoft.Sql/servers/read
• Microsoft.Support/*
• Microsoft.Insights/metrics/read
• Microsoft.Insights/metricDefinitions/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (24)

• Microsoft.Sql/servers/databases/ledgerDigestUploads/write
• Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action
• Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*
• Microsoft.Sql/managedInstances/databases/sensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*
• Microsoft.Sql/managedInstances/securityAlertPolicies/*
• Microsoft.Sql/managedInstances/vulnerabilityAssessments/*
• Microsoft.Sql/servers/databases/auditingSettings/*
• Microsoft.Sql/servers/databases/auditRecords/read
• Microsoft.Sql/servers/databases/currentSensitivityLabels/*
• Microsoft.Sql/servers/databases/dataMaskingPolicies/*
• Microsoft.Sql/servers/databases/extendedAuditingSettings/*
• Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*
• Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*
• Microsoft.Sql/servers/databases/securityAlertPolicies/*
• Microsoft.Sql/servers/databases/securityMetrics/*
• Microsoft.Sql/servers/databases/sensitivityLabels/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessments/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*
• Microsoft.Sql/servers/vulnerabilityAssessments/*

Assignable scopes (1)

• /

Practical scope

Assign on an individual database or a resource group containing the databases the operator manages. Parent-scope assignments are inherited. Azure RBAC controls management of Azure SQL resources; SQL users, logins, database roles, and database-engine permissions separately control queries and data access.

Common use cases (2)

• Create and manage single databases through the Azure portal, PowerShell, Azure CLI, REST, or deployments on an existing logical server.
• Operate database configuration, service tier, scaling, availability, and lifecycle without parent-server or security-policy administration.

Prerequisites (2)

• An Azure subscription and logical server must exist or be managed by a separately authorized server administrator.
• Grant SQL database users or roles separately when the same person or application must connect to and query the database.

Best practices (3)

• Use this database-scoped role instead of SQL Server Contributor when parent-server management is unnecessary, and use a custom role for still narrower management duties.
• Keep database-engine permissions and security-policy administration separate and grant users only the SQL permissions needed for their job.
• Scope to the individual database or dedicated resource group, audit management activity, and use time-bound access for human operators where available.

Security considerations (3)

• The role can create, resize, change, and delete databases in scope, affecting availability, integrity, and cost.
• It cannot access database contents through Azure RBAC DataActions and excludes the published security-policy operations.
• A SQL login or database user can still have independent data permissions, so review Azure and database-engine authorization together.

Assignment guidance

Assign SQL DB Contributor to the database operations identity on the individual database or dedicated resource group. Keep logical-server administration on SQL Server Contributor, security settings on SQL Security Manager, and SQL data permissions in database users and roles.

Related roles (2)

• SQL Server Contributor: Adds logical-server and database management while retaining exclusions for security policies and database data access.
• SQL Security Manager: Manages the SQL security-related policies deliberately excluded from SQL DB Contributor.

Editorial sources (6)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Create and manage servers and single databases in Azure SQL Database →

  Supports: Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Azure SQL Database and SQL Managed Instance security capabilities →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure SQL Database →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →