What role do I need to add to an application to enable it to add databases to a resource group?

Question

I'm trying to write a proof of concept for a provisioning app to create all the needed SQL resources for a new environment. I created an app registration and gave it the permissions SQL DB Contributor and SQL Managed Access Contributor. Based on the descriptions, this should give it SQL Write access. I know the roles are being applied because since I added them, I stopped getting the error that I do not have Read permissions and started getting an error that I do not have Write permissions. Which role would I actually need to give the app to be able to provision databases?

Answer 1

The SQL DB Contributor and SQL Managed Instance Contributor roles provide broad permissions for managing existing databases and instances, but they may not include permissions to create new resources. For provisioning new databases, you might need more elevated permissions such as the Owner or Contributor role at the resource group or subscription level. These roles grant the ability to create and manage all types of Azure resources, including Azure SQL databases. Please check your current role assignments and consider assigning the Contributor role at the resource group where you intend to provision the databases. This should resolve the write permissions error you are encountering.

Answer 2

A related question, is there a better resource to find good code examples that show exactly how to use azure.resourcemanager.sql package in .NET? All the resources I can find either give a list of dozens of methods with no context or they apply to a deprecated version of the package. It was tough just to figure out how to add a database, much less add it to an elastic versus vCore based pool.

Answer 3

Thanks for the responses. Using the Contributor role worked, but it kinda feels like overkill for a provisioning app, are admin level privileges the only way to give an app the ability to programmatically provision databases?

Answer 4

@Christopher Clark Thank you for reaching out. In addition to the above answers. From https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#sql-server-contributor:

The role includes the Microsoft.Sql/servers/* action. The * means that it also includes Microsoft.Sql/servers/databases/*.

Regards, Oury

Answer 5

For provisioning Azure SQL databases, in order to allow an application to add the CPU database packages for example as mentioned above IDs into a resource group within azure you need not only ensure that then given levels of permission at the level however it also needs and must be guaranteed even from entry point onward added functionality. The above-mentioned roles, SQL DB Contributor and SQL Managed Instance Adventurer, provide appropriate content responsibility concerning Azure SQL resources. Consquently, resource labor requires work of operation at the level of a resources group including deployment of resources.

For your application to have the capability to provision databases, you should consider adding it to one of the following roles at the resource group (or subscription, depending on the scope of your operations) level:Despite protests by the Natives, they were relocated to South Park with a provision for tents from which meals could be provided.

1. Contributor: This function enables the holder of this role to only be able generate, manage and control all Azure resources however it does not provide any form access for granting roles in azure RBAC or management allocation. This is a blanket permission and needs to be used with moderation, more so in the production settings.
2. Owner: This position has all the access to Azure resources, which even include delegating permission. It allows controlling all the elements that form a part of resource group including role assignments. Just like the Contributor role, this is a very strong permission that needs to be limited among applications and users with rad full access only.

Links : https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/resource-limits?view=azuresql