Azure Database for PostgreSQL
An Azure managed PostgreSQL database service for app development and deployment.
1,428 questions
Workloads failing on Azure Postgres flexible server.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 57.00000000000001%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJJ%3C/text%3E%3C/svg%3E)
Julian Jarminowski
30
Reputation points
Workloads that are newly started on our database are failing with the error: "ERROR: Only members of "azure_pg_admin" are allowed to use CREATE EXTENSION [Failed SQL: (0) CREATE EXTENSION IF NOT EXISTS "uuid-ossp"".
This was working before the emergency update in the last days. But according to the postgres docs admin permissions are not necessary: "This module is considered \“trusted\”, that is, it can be installed by non-superusers who have CREATE privilege on the current database." Source: https://www.postgresql.org/docs/15/uuid-ossp.html..
This also happens after adding the "uuid-ossp" extension to the Server Parameters "azure.extensions". Manually creating the extension ahead of time with an admin account does not work; it appears that PostgreSQL is checking permissions for the "CREATE EXTENSION IF EXISTS..." even if the extension does already exist, triggering an error. How can we resolve this as quickly as possible?
Azure Database for PostgreSQL
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 95%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESD%3C/text%3E%3C/svg%3E)
Saraswathi Devadula 5,570 Reputation points Microsoft External Staff Moderator2025-03-26T17:51:35.8233333+00:00 Hello Julian Jarminowski
I understand that you were unable to CREATE EXTENSION [Failed SQL: (0) CREATE EXTENSION IF NOT EXISTS "uuid-ossp"".
Could you please share the requested details over the private message?
Thank you.
-
Saraswathi Devadula 5,570 Reputation points Microsoft External Staff Moderator
2025-03-27T15:36:47.04+00:00 Hello Julian Jarminowski
Following our discussion, your database is failing with the error: "ERROR: Only members of "azure_pg_admin" are allowed to use CREATE EXTENSION [Failed SQL: (0) CREATE EXTENSION IF NOT EXISTS "uuid-ossp"". Please be informed that the user that creates the extensions must be a member of the
azure_pg_adminrole, which was not required earlier.Kindly please review the information, which we got from the internal team.
Issue: The customer was unable to create the extension using a non-admin user.
Root Cause: Before diving into the specifics, it’s important to clarify the distinctions between trusted and untrusted extensions
Trusted Extensions:
"Trusted" extensions are considered safe for installation and use by non-superuser roles. These extensions do not perform unsafe operations, such as direct file system access or execution of arbitrary code. They typically include additional data types or simple functions that do not require elevated privileges.
Non-Trusted Extensions:
"Untrusted" extensions generally require superuser privileges to install and use, as they may perform operations that could compromise the security or integrity of the database, such as interacting with the file system or executing arbitrary code.
Extension Management Before and After Our Latest Release.
Before rollout, extensions marked as "trusted" by a superuser could be installed by unprivileged users (those not part of the
azure_pg_admingroup) using theCREATE EXTENSIONcommand. To determine if an extension is trusted, the official documentation is the best reference.After release, regardless of whether an extension is trusted or untrusted, users must be members of the
azure_pg_admingroup to create extensions. This is why the client encountered this behavior with trusted extensions.Mitigation: We apologize for any inconvenience this may have caused. However, this behaviour enhances security and is more appropriate. Please ensure that users with admin privileges create this extension.
However, you want to understand why Microsoft made a breaking change to PostgreSQL Flexible Server and silently implemented it without warning or prior authorization to the clients, which is a significant oversight.
- This change is likely aimed at enhancing security and preventing unauthorized modifications.
-
Saraswathi Devadula 5,570 Reputation points Microsoft External Staff Moderator
2025-03-31T12:43:26.44+00:00 Hello Julian Jarminowski
Greetings of the day...!!
Following our discussion, please be informed that the rollout is in progress, and we are prioritizing it.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 96%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EI%3C/text%3E%3C/svg%3E)
ianso 0 Reputation points2025-04-04T05:45:39.8733333+00:00 Dear @Saraswathi Devadula ,
Very sorry but could you please clarify, the rollout of what is in progress? Are you adapting/reverting this new behaviour of M41, or continuing to roll out M41?
Many thanks in advance & best regards
-I
-
Deleted
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 62%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
primalcode0 0 Reputation points2025-04-15T08:49:31.57+00:00 @PratikLad Is there any update on this, we have an azure app service container that connects to a postgres flexible backend that has been unable to bring the container up because it runs scripts that install extensions on the fly. This M41 update broke our live service. It appears the only way for us to fix this is to elevate the user permissions of our app to be an ADMIN of our database server, ironic this change was supposed to enhance security!
Sign in to comment
Sign in to answer