Postgres version upgrade: Broken user/role management after upgrade to v16

Question

Postgres version upgrade: Broken user/role management after upgrade to v16

Alexander Harrington 20

Hello, I am having issues with my Postgres instance (Azure Flexible Server for Postgres).

After the upgrade from V12 to V16 (more specifically, the issue stems from the upgrade to V16), we lost the ability to modify existing users and roles in our database - but we can still create new users and roles. We have received support on this issue before, but the issue has persisted / regressed.

When attempting to modify any existing user or role, we get the error message from Postgres:

ERROR: permission denied to grant role 'role_x' Detail: Only roles with the ADMIN option on role 'user_a' may grant this role.

The issue is reportedly known by Microsoft, as it was a bug introduced by their handling of the vX-to-v16 migration (confirmed by support personnel in first round of support, as well as in below link).

https://learn.microsoft.com/en-us/answers/questions/1835378/can-not-manage-roles-in-v16-that-where-created-in

We only have a developer support plan, and the generic MS support from admin.microsoft.com is not able to help, because it is too technical. However, given that the issue was introduced by MS itself, I expect adequate support regardless of our support plan.

Mahesh Kurva 5,025 Reputation points Microsoft External Staff Moderator

2025-06-13T09:14:59.3333333+00:00

Hi Alexander Harrington,

I kindly request you to please share the details requested in the private message, which will help us to address your query.
Alexander Harrington 20 Reputation points

2025-06-13T09:20:22.0833333+00:00

Thank you for the very quick response. I will follow up in private messages :)
Mahesh Kurva 5,025 Reputation points Microsoft External Staff Moderator

2025-06-13T09:35:23.69+00:00
Hi Alexander Harrington,

Thanks for sharing the details.

ERROR: permission denied to grant role 'role_x' Detail: Only roles with the ADMIN option on role 'user_a' may grant this role.

In v16:

A user must have the ADMIN OPTION on a role in order to grant or revoke membership in that role.

CREATEROLE alone no longer allows this.

A user with CREATEROLE can still create users but can only drop users they created themselves.

For more information, please refer the document:

PostgreSQL 16 changes with role based security.

I hope this information helps. Please do let us know if you have any further queries.
Alexander Harrington 20 Reputation points

2025-06-13T10:14:29.3266667+00:00

Hello again Mahesh. I am aware of this change, but the issue is for our root user of the instance, listed in the Azure portal. This user was supposed to have admin rights over the DB and only be used for admin-related tasks, but since the upgrade, it lost the ability to manage existing users and roles. It can, however, create new roles.

As mentioned, it was a regression introduced by the v12-to-v16 upgrade being improperly rolled out by Microsoft (as per https://learn.microsoft.com/en-us/answers/questions/1835378/can-not-manage-roles-in-v16-that-where-created-in and our contact with personnel about a year ago), so it will require closer support from you guys.
Mahesh Kurva 5,025 Reputation points Microsoft External Staff Moderator

2025-06-25T11:19:31.97+00:00

Hi Alexander Harrington,

Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Alexander Harrington 20 Reputation points

2025-06-25T12:16:01.47+00:00

Hello again.

It did indeed take a lot of interaction with the backend team (with some work still being done). The backend team did/are doing the following:

1: Took our database admin role (as can be seen in the Azure portal for the database) and assigned it as role member with the "WITH ADMIN" option on all our roles in the database.
2: Changed the "grantor" property of all role memberships from azuresu (Microsofts backend superuser) to our admin role. Without this change, it was impossible for us to remove roles from being members of other roles (i.e. removing users from groups)

Although I am still awaiting the completion of step 2, I am confident it will be resolved by the backend team.

Thank you for your help :)

Accepted answer

0 additional answers

Your answer

Mahesh Kurva 5,025 Reputation points Microsoft External Staff Moderator

2025-06-13T09:14:59.3333333+00:00

Hi Alexander Harrington,

I kindly request you to please share the details requested in the private message, which will help us to address your query.
Alexander Harrington 20 Reputation points

2025-06-13T09:20:22.0833333+00:00

Thank you for the very quick response. I will follow up in private messages :)
Mahesh Kurva 5,025 Reputation points Microsoft External Staff Moderator

2025-06-13T09:35:23.69+00:00

Hi Alexander Harrington,

Thanks for sharing the details.

ERROR: permission denied to grant role 'role_x' Detail: Only roles with the ADMIN option on role 'user_a' may grant this role.

In v16:

A user must have the ADMIN OPTION on a role in order to grant or revoke membership in that role.

CREATEROLE alone no longer allows this.

A user with CREATEROLE can still create users but can only drop users they created themselves.

For more information, please refer the document:

PostgreSQL 16 changes with role based security.

I hope this information helps. Please do let us know if you have any further queries.
Alexander Harrington 20 Reputation points

2025-06-13T10:14:29.3266667+00:00

Hello again Mahesh. I am aware of this change, but the issue is for our root user of the instance, listed in the Azure portal. This user was supposed to have admin rights over the DB and only be used for admin-related tasks, but since the upgrade, it lost the ability to manage existing users and roles. It can, however, create new roles.

As mentioned, it was a regression introduced by the v12-to-v16 upgrade being improperly rolled out by Microsoft (as per https://learn.microsoft.com/en-us/answers/questions/1835378/can-not-manage-roles-in-v16-that-where-created-in and our contact with personnel about a year ago), so it will require closer support from you guys.
Mahesh Kurva 5,025 Reputation points Microsoft External Staff Moderator

2025-06-25T11:19:31.97+00:00

Hi Alexander Harrington,

Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Alexander Harrington 20 Reputation points

2025-06-25T12:16:01.47+00:00

Hello again.

It did indeed take a lot of interaction with the backend team (with some work still being done). The backend team did/are doing the following:

1: Took our database admin role (as can be seen in the Azure portal for the database) and assigned it as role member with the "WITH ADMIN" option on all our roles in the database.
2: Changed the "grantor" property of all role memberships from azuresu (Microsofts backend superuser) to our admin role. Without this change, it was impossible for us to remove roles from being members of other roles (i.e. removing users from groups)

Although I am still awaiting the completion of step 2, I am confident it will be resolved by the backend team.

Thank you for your help :)

Answer 1

Mahesh Kurva 5,025 Microsoft External Staff Moderator

Hi Alexander Harrington,

The issue you’re experiencing—receiving the Postgres error ERROR: permission denied to grant role 'role_x' after upgrading from V12 to V16—is related to changes in role and permission handling in the newer version.

The issue was resolved by the backend team by ensuring the user performing the role/user modifications has the necessary privileges, specifically the ADMIN OPTION on the roles being modified.

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

If this answers your query, do click Accept Answer and Upvote for was this answer helpful. User's image

Alexander Harrington 20 Reputation points

2025-06-25T12:17:24.87+00:00

Hello again.

It did indeed take a lot of interaction with the backend team (with some work still being done). The backend team did/are doing the following:

1: Took our database admin role (as can be seen in the Azure portal for the database) and assigned it as role member with the "WITH ADMIN" option on all our roles in the database. 2: Changed the "grantor" property of all role memberships from azuresu (Microsofts backend superuser) to our admin role. Without this change, it was impossible for us to remove roles from being members of other roles (i.e. removing users from groups)

Although I am still awaiting the completion of step 2, I am confident it will be resolved by the backend team.

Thank you for your help :)

Share via

Postgres version upgrade: Broken user/role management after upgrade to v16

0 additional answers

Your answer