Share via

Best practice to grant admin (or silmilar) access to our SQL server instances in Azure

Nicholas Dunkle 21 Reputation points
2022-08-01T17:39:48.393+00:00

I have a user that is requesting admin access on all of the SQL server instances in our environment for DB monitoring setup. I know they may not need actual administrator rights in azure, but what would be the best, most secure way, to delegate these permissions? These instances are in many different resource groups and subscriptions, so going into them one at a time is obviously not going to work.

Thank you!

Azure SQL Database
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
702 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Szymon Lasota 1 Reputation point
    2022-08-02T06:42:59.163+00:00

    If you have a management group that covers all subscriptions then you can assign RBAC role (or even better create custom RBAC if MS roles would be not good enough) and user will get access to all resources/resource groups/subscriptions in that MG.

    But is that user really required to have access in Azure Portal or maybe just access to DB with SSMS/other tools is needed?

    Anyway for that you have Azure AD Admin - if you have it enabled for group - and by any change that is same group along all your servers - then this will be easy to add him to that group.

    If not - you can create new group with this user in it - and add group as user to all DB with required permissions - via registered servers in ssms - that would allow you to execute query at all Databases with just one click.