Azure Databases built-in role
SQL Server Contributor
Broadly manages Azure SQL logical servers and their databases through the control plane while excluding security-related policies and database data access. It has no DataActions and does not grant SQL login, user, role, or query permissions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437
Control-plane actions (10)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Sql/locations/*/readMicrosoft.Sql/servers/*Microsoft.Support/*Microsoft.Insights/metrics/readMicrosoft.Insights/metricDefinitions/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (30)
Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*Microsoft.Sql/managedInstances/databases/sensitivityLabels/*Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*Microsoft.Sql/managedInstances/securityAlertPolicies/*Microsoft.Sql/managedInstances/vulnerabilityAssessments/*Microsoft.Sql/servers/auditingSettings/*Microsoft.Sql/servers/databases/auditingSettings/*Microsoft.Sql/servers/databases/auditRecords/readMicrosoft.Sql/servers/databases/currentSensitivityLabels/*Microsoft.Sql/servers/databases/dataMaskingPolicies/*Microsoft.Sql/servers/databases/extendedAuditingSettings/*Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*Microsoft.Sql/servers/databases/securityAlertPolicies/*Microsoft.Sql/servers/databases/securityMetrics/*Microsoft.Sql/servers/databases/sensitivityLabels/*Microsoft.Sql/servers/databases/vulnerabilityAssessments/*Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*Microsoft.Sql/servers/devOpsAuditingSettings/*Microsoft.Sql/servers/extendedAuditingSettings/*Microsoft.Sql/servers/securityAlertPolicies/*Microsoft.Sql/servers/vulnerabilityAssessments/*Microsoft.Sql/servers/azureADOnlyAuthentications/deleteMicrosoft.Sql/servers/azureADOnlyAuthentications/writeMicrosoft.Sql/servers/externalPolicyBasedAuthorizations/deleteMicrosoft.Sql/servers/externalPolicyBasedAuthorizations/write
Assignable scopes (1)
/
Practical scope
Assign on an individual logical server or a dedicated resource group containing the servers and databases the operator owns. Parent-scope assignments are inherited. Azure RBAC governs resource management, while SQL authentication, Microsoft Entra principals, server roles, database roles, and SQL permissions govern the data plane.
Common use cases (2)
- Create and manage Azure SQL logical servers and single databases through the portal, PowerShell, Azure CLI, REST, or deployments.
- Operate server and database lifecycle, configuration, scaling, monitoring, and deployments while keeping security-policy administration separate.
Prerequisites (2)
- An Azure subscription and an approved server, database, region, networking, identity, and service-tier design are required.
- Grant SQL database users or roles separately for anyone who must connect to or query a database.
Best practices (3)
- Use SQL DB Contributor when the operator manages only databases on an existing logical server, and use a custom role for narrower server duties.
- Keep SQL Security Manager and database-engine access separate, restrict network exposure, and audit privileged management activity.
- Scope this broad contributor role to an individual server or dedicated resource group and use time-bound access for people where available.
Security considerations (3)
- The role can create, change, scale, or delete logical servers and databases, affecting availability, integrity, networking, and cost.
- It has no DataActions and excludes published security-policy operations, but server lifecycle changes can still disrupt every contained database.
- Independent SQL credentials and database roles can grant data access even when this Azure role does not, so both authorization planes require review.
Assignment guidance
Assign SQL Server Contributor to the logical-server operations identity on the individual server or dedicated resource group. Use SQL DB Contributor for database-only administration, SQL Security Manager for security policies, and SQL principals and roles for data access.
Related roles (2)
- SQL DB Contributor: Narrower management role for databases on an existing logical server without parent-server management.
- SQL Security Manager: Manages the security-related policies explicitly excluded from SQL Server Contributor.
Common questions
When should I assign the SQL Server Contributor Azure role?
Assign SQL Server Contributor when you need to: Create and manage Azure SQL logical servers and single databases through the portal, PowerShell, Azure CLI, REST, or deployments.; and Operate server and database lifecycle, configuration, scaling, monitoring, and deployments while keeping security-policy administration separate.. Practical scope: Assign on an individual logical server or a dedicated resource group containing the servers and databases the operator owns. Parent-scope assignments are inherited. Azure RBAC governs resource management, while SQL authentication, Microsoft Entra principals, server roles, database roles, and SQL permissions govern the data plane.
What permissions does the SQL Server Contributor Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Sql/locations/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the SQL Server Contributor Azure role?
Key considerations when assigning SQL Server Contributor: The role can create, change, scale, or delete logical servers and databases, affecting availability, integrity, networking, and cost.; It has no DataActions and excludes published security-policy operations, but server lifecycle changes can still disrupt every contained database.; and Independent SQL credentials and database roles can grant data access even when this Azure role does not, so both authorization planes require review.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Databases →
Supports: Description, Practical scope, Common use cases, Security considerations, Related roles. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Create and manage servers and single databases in Azure SQL Database →
Supports: Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Azure SQL Database and SQL Managed Instance security capabilities →
Supports: Description, Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Secure your Azure SQL Database →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.