Azure Databases built-in role

SQL Security Manager

Manages security-related policies for Azure SQL logical servers, databases, and managed instances without granting database data access. Its control-plane Actions cover security features such as auditing, threat protection, vulnerability assessment, masking, sensitivity labels, firewall rules, encryption settings, and Microsoft Entra-only authentication; it has no DataActions.

Control-plane actions (73)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Sql/locations/administratorAzureAsyncOperation/read
• Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read
• Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write
• Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read
• Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write
• Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read
• Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write
• Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read
• Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write
• Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*
• Microsoft.Sql/managedInstances/databases/sensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*
• Microsoft.Sql/servers/advancedThreatProtectionSettings/read
• Microsoft.Sql/servers/advancedThreatProtectionSettings/write
• Microsoft.Sql/managedInstances/securityAlertPolicies/*
• Microsoft.Sql/managedInstances/databases/transparentDataEncryption/*
• Microsoft.Sql/managedInstances/vulnerabilityAssessments/*
• Microsoft.Sql/managedInstances/serverConfigurationOptions/read
• Microsoft.Sql/managedInstances/serverConfigurationOptions/write
• Microsoft.Sql/locations/serverConfigurationOptionAzureAsyncOperation/read
• Microsoft.Sql/servers/advancedThreatProtectionSettings/read
• Microsoft.Sql/servers/advancedThreatProtectionSettings/write
• Microsoft.Sql/servers/auditingSettings/*
• Microsoft.Sql/servers/extendedAuditingSettings/*
• Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read
• Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write
• Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read
• Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write
• Microsoft.Sql/servers/databases/auditingSettings/*
• Microsoft.Sql/servers/databases/auditRecords/read
• Microsoft.Sql/servers/databases/currentSensitivityLabels/*
• Microsoft.Sql/servers/databases/dataMaskingPolicies/*
• Microsoft.Sql/servers/databases/extendedAuditingSettings/read
• Microsoft.Sql/servers/databases/read
• Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*
• Microsoft.Sql/servers/databases/schemas/read
• Microsoft.Sql/servers/databases/schemas/tables/columns/read
• Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*
• Microsoft.Sql/servers/databases/schemas/tables/read
• Microsoft.Sql/servers/databases/securityAlertPolicies/*
• Microsoft.Sql/servers/databases/securityMetrics/*
• Microsoft.Sql/servers/databases/sensitivityLabels/*
• Microsoft.Sql/servers/databases/transparentDataEncryption/*
• Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessments/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*
• Microsoft.Sql/servers/devOpsAuditingSettings/*
• Microsoft.Sql/servers/firewallRules/*
• Microsoft.Sql/servers/read
• Microsoft.Sql/servers/securityAlertPolicies/*
• Microsoft.Sql/servers/sqlvulnerabilityAssessments/*
• Microsoft.Sql/servers/vulnerabilityAssessments/*
• Microsoft.Support/*
• Microsoft.Sql/servers/azureADOnlyAuthentications/*
• Microsoft.Sql/managedInstances/read
• Microsoft.Sql/managedInstances/azureADOnlyAuthentications/*
• Microsoft.Security/sqlVulnerabilityAssessments/*
• Microsoft.Sql/managedInstances/administrators/read
• Microsoft.Sql/servers/administrators/read
• Microsoft.Sql/servers/databases/ledgerDigestUploads/*
• Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read
• Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read
• Microsoft.Sql/servers/externalPolicyBasedAuthorizations/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the SQL server, managed instance, database, or dedicated resource group containing the security resources the administrator owns. Parent-scope assignments are inherited. SQL queries and database-engine permissions remain separate from these Azure control-plane security settings.

Common use cases (2)

• Configure and maintain Azure SQL auditing, threat-protection, vulnerability-assessment, data-masking, sensitivity-label, firewall, and encryption policies.
• Enable, disable, or verify Microsoft Entra-only authentication for an Azure SQL logical server or managed instance.

Prerequisites (2)

• The SQL logical server, database, or managed instance must exist and the organization must define which security policies the assignee administers.
• Grant SQL database users, logins, server roles, or database roles separately if the administrator also needs to inspect or query data.

Best practices (3)

• Keep security-policy administration separate from routine database and server lifecycle management where duties require separation.
• Use Microsoft Entra-only authentication where supported, restrict network access, enable auditing and threat detection, and review security changes regularly.
• Assign at the narrowest SQL resource boundary and use eligible or time-bound access for human security administrators where available.

Security considerations (3)

• The role can materially change authentication, firewall, auditing, threat detection, vulnerability, masking, labeling, and encryption controls.
• It has no DataActions and does not itself grant SQL query access, but weakening a security or network policy can increase exposure to other credentials and clients.
• Combining this role with SQL lifecycle and database-engine administration removes separation between infrastructure, security policy, and data access.

Assignment guidance

Assign SQL Security Manager to the database security team on the individual logical server, managed instance, database, or dedicated security scope. Keep SQL DB, Server, or Managed Instance Contributor and database-engine permissions separate unless the same trusted administrator explicitly owns those duties.

Related roles (3)

• SQL DB Contributor: Manages database lifecycle while excluding the security-policy operations assigned to SQL Security Manager.
• SQL Server Contributor: Manages logical servers and databases while excluding their security-related policies.
• SQL Managed Instance Contributor: Manages managed-instance and network lifecycle but cannot change Microsoft Entra-only authentication.

Editorial sources (6)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Azure SQL Database and SQL Managed Instance security capabilities →

  Supports: Description, Practical scope, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Secure your Azure SQL Database →

  Supports: Common use cases, Best practices, Security considerations. Retrieved 2026-07-16.

• Enable Microsoft Entra-only authentication with Azure SQL →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →