Azure built-in roles · databases
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 51338d7 · +2 −2 lines · also on GitHub
⋯ 646 unchanged lines
647647
648648
## SQL DB Contributor
649649
650
−Lets you manage SQL databases, but not access to them. Also, you can't manage their security-related policies or their parent SQL servers.
650
+Lets you manage SQL databases, including copying, restoring, exporting, deleting, and configuring certain database-level security settings such as identities, encryption protectors, and enclaves. Although it grants no SQL query permissions directly, its data-movement capabilities can enable access to or exfiltration of database data. It cannot manage parent SQL servers and excludes the security-related operations listed in NotActions.
651651
652652
[Learn more](/azure/data-share/concepts-roles-permissions)
653653
⋯ 358 unchanged lines
10121012
10131013
## SQL Server Contributor
10141014
1015
−Lets you manage SQL servers and databases, but not access to them, and not their security-related policies.
1015
+Lets you manage SQL servers and databases, including server administrator credentials and certain server security and network settings. Although it grants no SQL data-plane permissions directly, control of administrator credentials can enable data-plane access. It excludes the security-related policies listed in NotActions.
10161016
10171017
[Learn more](/azure/azure-sql/database/authentication-aad-configure)
10181018
⋯ 116 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:48 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.