Azure Databases built-in role

SQL Security Manager

Manages security-related policies for Azure SQL logical servers, databases, and managed instances without granting database data access. Its control-plane Actions cover security features such as auditing, threat protection, vulnerability assessment, masking, sensitivity labels, firewall rules, encryption settings, and Microsoft Entra-only authentication; it has no DataActions.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 056cd41c-7e88-42e1-933e-88ba6a50c9c3

Control-plane actions (73)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the SQL server, managed instance, database, or dedicated resource group containing the security resources the administrator owns. Parent-scope assignments are inherited. SQL queries and database-engine permissions remain separate from these Azure control-plane security settings.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign SQL Security Manager to the database security team on the individual logical server, managed instance, database, or dedicated security scope. Keep SQL DB, Server, or Managed Instance Contributor and database-engine permissions separate unless the same trusted administrator explicitly owns those duties.

Related roles (3)

Common questions

When should I assign the SQL Security Manager Azure role?

Assign SQL Security Manager when you need to: Configure and maintain Azure SQL auditing, threat-protection, vulnerability-assessment, data-masking, sensitivity-label, firewall, and encryption policies.; and Enable, disable, or verify Microsoft Entra-only authentication for an Azure SQL logical server or managed instance.. Practical scope: Assign on the SQL server, managed instance, database, or dedicated resource group containing the security resources the administrator owns. Parent-scope assignments are inherited. SQL queries and database-engine permissions remain separate from these Azure control-plane security settings.

What permissions does the SQL Security Manager Azure role grant?

The role definition grants 73 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the SQL Security Manager Azure role?

Key considerations when assigning SQL Security Manager: The role can materially change authentication, firewall, auditing, threat detection, vulnerability, masking, labeling, and encryption controls.; It has no DataActions and does not itself grant SQL query access, but weakening a security or network policy can increase exposure to other credentials and clients.; and Combining this role with SQL lifecycle and database-engine administration removes separation between infrastructure, security policy, and data access.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →