Azure Databases built-in role

SQL Server Contributor

Broadly manages Azure SQL logical servers and their databases through the control plane while excluding security-related policies and database data access. It has no DataActions and does not grant SQL login, user, role, or query permissions.

Control-plane actions (10)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Sql/locations/*/read
• Microsoft.Sql/servers/*
• Microsoft.Support/*
• Microsoft.Insights/metrics/read
• Microsoft.Insights/metricDefinitions/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (30)

• Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*
• Microsoft.Sql/managedInstances/databases/sensitivityLabels/*
• Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*
• Microsoft.Sql/managedInstances/securityAlertPolicies/*
• Microsoft.Sql/managedInstances/vulnerabilityAssessments/*
• Microsoft.Sql/servers/auditingSettings/*
• Microsoft.Sql/servers/databases/auditingSettings/*
• Microsoft.Sql/servers/databases/auditRecords/read
• Microsoft.Sql/servers/databases/currentSensitivityLabels/*
• Microsoft.Sql/servers/databases/dataMaskingPolicies/*
• Microsoft.Sql/servers/databases/extendedAuditingSettings/*
• Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*
• Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*
• Microsoft.Sql/servers/databases/securityAlertPolicies/*
• Microsoft.Sql/servers/databases/securityMetrics/*
• Microsoft.Sql/servers/databases/sensitivityLabels/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessments/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*
• Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*
• Microsoft.Sql/servers/devOpsAuditingSettings/*
• Microsoft.Sql/servers/extendedAuditingSettings/*
• Microsoft.Sql/servers/securityAlertPolicies/*
• Microsoft.Sql/servers/vulnerabilityAssessments/*
• Microsoft.Sql/servers/azureADOnlyAuthentications/delete
• Microsoft.Sql/servers/azureADOnlyAuthentications/write
• Microsoft.Sql/servers/externalPolicyBasedAuthorizations/delete
• Microsoft.Sql/servers/externalPolicyBasedAuthorizations/write

Assignable scopes (1)

• /

Practical scope

Assign on an individual logical server or a dedicated resource group containing the servers and databases the operator owns. Parent-scope assignments are inherited. Azure RBAC governs resource management, while SQL authentication, Microsoft Entra principals, server roles, database roles, and SQL permissions govern the data plane.

Common use cases (2)

• Create and manage Azure SQL logical servers and single databases through the portal, PowerShell, Azure CLI, REST, or deployments.
• Operate server and database lifecycle, configuration, scaling, monitoring, and deployments while keeping security-policy administration separate.

Prerequisites (2)

• An Azure subscription and an approved server, database, region, networking, identity, and service-tier design are required.
• Grant SQL database users or roles separately for anyone who must connect to or query a database.

Best practices (3)

• Use SQL DB Contributor when the operator manages only databases on an existing logical server, and use a custom role for narrower server duties.
• Keep SQL Security Manager and database-engine access separate, restrict network exposure, and audit privileged management activity.
• Scope this broad contributor role to an individual server or dedicated resource group and use time-bound access for people where available.

Security considerations (3)

• The role can create, change, scale, or delete logical servers and databases, affecting availability, integrity, networking, and cost.
• It has no DataActions and excludes published security-policy operations, but server lifecycle changes can still disrupt every contained database.
• Independent SQL credentials and database roles can grant data access even when this Azure role does not, so both authorization planes require review.

Assignment guidance

Assign SQL Server Contributor to the logical-server operations identity on the individual server or dedicated resource group. Use SQL DB Contributor for database-only administration, SQL Security Manager for security policies, and SQL principals and roles for data access.

Related roles (2)

• SQL DB Contributor: Narrower management role for databases on an existing logical server without parent-server management.
• SQL Security Manager: Manages the security-related policies explicitly excluded from SQL Server Contributor.

Editorial sources (6)

• Azure built-in roles for Databases →

  Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Create and manage servers and single databases in Azure SQL Database →

  Supports: Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Azure SQL Database and SQL Managed Instance security capabilities →

  Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure SQL Database →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →