Azure Databases built-in role

SQL Managed Instance Contributor

Broadly manages Azure SQL Managed Instances and the virtual networks, subnets, network security groups, route tables, failover groups, and deployments required by the service. It has no DataActions, cannot grant Azure RBAC access, and excludes changes to Microsoft Entra-only authentication.

Control-plane actions (15)

• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Network/networkSecurityGroups/*
• Microsoft.Network/routeTables/*
• Microsoft.Sql/locations/*/read
• Microsoft.Sql/locations/instanceFailoverGroups/*
• Microsoft.Sql/managedInstances/*
• Microsoft.Support/*
• Microsoft.Network/virtualNetworks/subnets/*
• Microsoft.Network/virtualNetworks/*
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/metrics/read
• Microsoft.Insights/metricDefinitions/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (2)

• Microsoft.Sql/managedInstances/azureADOnlyAuthentications/delete
• Microsoft.Sql/managedInstances/azureADOnlyAuthentications/write

Assignable scopes (1)

• /

Practical scope

Microsoft documents subscription scope for general provisioning because the role manages the instance and required network resources. When the subnet is already delegated and prepared, a custom or narrower permission containing Microsoft.Sql/managedInstances/write can be sufficient. SQL data access remains separate database-engine authorization.

Common use cases (2)

• Deploy and manage a SQL Managed Instance together with its required virtual network, subnet, route table, and network security group resources.
• Operate managed-instance lifecycle, configuration, monitoring, and failover groups without Azure RBAC delegation or database data access.

Prerequisites (3)

• Plan the SQL Managed Instance region, service tier, subnet, routing, network security, DNS, connectivity, identity, and capacity requirements.
• For the general deployment path, assign at subscription scope; for an already delegated subnet, review whether only managedInstances/write is required.
• Grant SQL logins, Microsoft Entra principals, server roles, and database roles separately for data-plane access.

Best practices (3)

• Do not call this broad infrastructure role least privilege; use a custom role when the virtual network is already prepared or the operator needs only a subset of lifecycle operations.
• Use a dedicated subnet, private connectivity, restrictive network security rules, and separate security-policy administration.
• Use eligible or time-bound assignment for human provisioning identities and review subscription-wide access regularly.

Security considerations (3)

• The role can change or delete managed instances and required network infrastructure, creating a large availability, connectivity, and cost impact.
• It has no DataActions and does not grant database-engine access, but network changes can expose or isolate the service.
• It cannot enable or disable Microsoft Entra-only authentication and cannot assign Azure roles; those controls remain separate.

Assignment guidance

Use SQL Managed Instance Contributor for a trusted provisioning identity only when it must manage both the instance and required network infrastructure. Follow Microsoft subscription-scope guidance for general provisioning, but prefer a narrower custom role for an already delegated subnet and keep SQL data and security administration separate.

Related roles (1)

• SQL Security Manager: Microsoft documents SQL Security Manager for changing Microsoft Entra-only authentication, which SQL Managed Instance Contributor can inspect but not enable or disable.

Editorial sources (6)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Create an Azure SQL Managed Instance using Bicep →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Secure your Azure SQL Managed Instance →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Enable Microsoft Entra-only authentication with Azure SQL →

  Supports: Security considerations, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →