Missing Cosmos DB Built-in Data Reader and Cosmos DB Built-in Data Contributor roles in Access Control (IAM)

Question

I'm trying to assign roles to managed identity in Cosmos DB, through browser using Access Control (IAM).

Unfortunately two build in roles Cosmos DB Built-in Data Reader and Cosmos DB Built-in Data Contributor are not there.

How can I add managed identity in this roles in Cosmos DB through browser?

Answer 1

If the built-in roles "Cosmos DB Built-in Data Reader" and "Cosmos DB Built-in Data Contributor" are not available in the Azure portal's Access Control (IAM) blade for Cosmos DB, it's likely because these roles were not present in your subscription when it was created or because your subscription might not have the necessary permissions to assign these roles.

However, you can still assign custom roles to the managed identity in Cosmos DB. Here's how you can do it through the Azure portal:

1. Navigate to your Cosmos DB account in the Azure portal.
2. Click on "Access Control (IAM)" in the left-hand menu.
3. Click on the "+ Add" button at the top of the "Role assignments" tab.
4. In the "Add role assignment" panel, select the "Role" dropdown and choose "Add custom role".
5. Create a custom role that aligns with the permissions you want to assign to the managed identity. You can define the permissions using JSON definition or select from existing roles and customize them.
6. Once you've defined the custom role, select the appropriate managed identity from the "Select" dropdown.
7. Click "Save" to assign the custom role to the managed identity.

Make sure that the custom role you define includes the necessary permissions for data reading or contribution based on your requirements.

Keep in mind that assigning custom roles may require sufficient permissions in your subscription and may also involve understanding the specific permissions needed for Cosmos DB data operations.

Answer 2

You can assign the role to your SP, MI, Account using Azure PowerShell or Azure CLI as follow:

For example, assigning the Cosmos DB Built-in Data Contributor to my ADF's system MI

az cosmosdb sql role assignment create --account-name comos-db-no-sql --resource-group comsos-db-rg --scope "/" --principal-id xxxxx --role-definition-id /subscriptions/xxxxx/resourceGroups/comsos-db-rg/providers/Microsoft.DocumentDB/databaseAccounts/comos-db-no-sql/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002

Answer 3

Hi, @Jacek Przezdziecki (ext) Welcome to the Microsoft Q&A platform, thanks for posting the question

You try checking from the CLi command and list the role, you can refer to this document for more information

you can refer to this blog on how to add RBAC using Managed identity,

Please let me know if you are looking for any additional information.

Regards

Geetha

Answer 4

Awesome, but how to assign user to this role through UI?