> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_sql_contributor.md).

# AZ\_SQL\_CONTRIBUTOR

## Summary

|                            |                                                                 |
| -------------------------- | --------------------------------------------------------------- |
| **Forestall ACL Alias**    | AZ\_SQL\_CONTRIBUTOR                                            |
| **Azure Alias**            | SQL Server Contributor                                          |
| **Affected Object Types**  | Azure SQL Servers                                               |
| **Exploitation Certainty** | Certain                                                         |
| **Severity**               | High                                                            |
| **Azure RBAC Roles**       | SQL Server Contributor (`6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437`) |

**Custom Role Actions:**

* `Microsoft.Sql/servers/*`

## Description

`AZ_SQL_CONTRIBUTOR` represents broad management-plane control over an Azure SQL Server via the built-in **SQL Server Contributor** role. A principal holding this role manages servers and databases — including resetting the server admin password and changing firewall rules — but cannot manage their security policies.

This is a **scope-level** edge: it states that the principal holds a contributor-grade role over the SQL scope. The concrete abuse primitives that role unlocks — resetting the admin password, exporting data, or taking over via the Entra admin — are carried by the resource-level edges [AZ\_SQL\_ACCESS](https://docs.forestall.io/fsprotect/edges/azure/az_sql_access) and [AZ\_SQL\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_sql_admin), which fan out on their own from this assignment.

`Owner` and `Contributor` also grant everything SQL Server Contributor grants (via wildcard `*`), plus the ability to set the Microsoft Entra administrator (`Microsoft.Sql/servers/administrators/write`), which SQL Server Contributor does **not** hold.

Related edges: [AZ\_SQL\_ACCESS](https://docs.forestall.io/fsprotect/edges/azure/az_sql_access), [AZ\_SQL\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_sql_admin).

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# List SQL contributor-grade assignments
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @(
            "SQL Server Contributor"
        )
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Include broad roles at SQL scopes
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @("Owner", "Contributor") -and
        $_.Scope -match "/Microsoft.Sql/"
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize
```

### Azure Portal

1. Open **Azure Portal** -> target **SQL server**.
2. Go to **Access control (IAM)** -> **Role assignments**.
3. Filter for **Owner**, **Contributor**, **SQL Server Contributor**, and custom roles with `Microsoft.Sql/servers/*`.
4. Review inherited assignments from the resource group, subscription, and management group.

## Exploitation

These examples are for authorized testing only.

### Pivot to Management-Plane Abuse

Firewall changes and admin password resets are the direct exploitation paths available to SQL Server Contributor. For detailed exploitation steps, see [AZ\_SQL\_ACCESS](https://docs.forestall.io/fsprotect/edges/azure/az_sql_access).

### Pivot to Full Takeover

Where the assignment is **Owner** or **Contributor** (not the dedicated SQL Server Contributor role), the principal can also set itself as the server's Microsoft Entra administrator, gaining `sysadmin`-equivalent access to every database. For detailed exploitation steps, see [AZ\_SQL\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_sql_admin).

## Mitigation

1. **Reduce broad SQL roles** - replace **Owner**/**Contributor** with the narrower **SQL Server Contributor** where full management access is not required.
2. **Use Privileged Identity Management** for temporary elevation to SQL Server Contributor.
3. **Enable Microsoft Entra-only authentication** to remove the admin-password-reset pivot to the data plane.
4. **Restrict the network path** with private endpoints and firewall rules, and monitor `Microsoft.Sql/servers/firewallRules/write`.
5. **Monitor inherited assignments** at subscription and resource-group scopes, not only direct SQL-scope assignments.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> target **SQL server** -> **Activity log**.
2. Review write operations against `Microsoft.Sql/servers/*`, especially admin-password resets and firewall rule changes.
3. Review **Access control (IAM)** for new or unexpected assignments of **Owner**, **Contributor**, or **SQL Server Contributor**.
4. Send Activity Log and Azure SQL Auditing logs to a SIEM and alert on configuration changes by unusual principals.

## References

* [Azure built-in roles for databases](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases)
* [SQL Server Contributor built-in role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases#sql-server-contributor)
* [Configure Microsoft Entra authentication for Azure SQL](https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure)