AZ_SQL_CONTRIBUTOR

Summary

Forestall ACL Alias	AZ_SQL_CONTRIBUTOR
Azure Alias	SQL Server Contributor
Affected Object Types	Azure SQL Servers
Exploitation Certainty	Certain
Severity	High
Azure RBAC Roles	SQL Server Contributor (6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437)

Custom Role Actions:

• Microsoft.Sql/servers/*

Description

AZ_SQL_CONTRIBUTOR represents broad management-plane control over an Azure SQL Server via the built-in SQL Server Contributor role. A principal holding this role manages servers and databases — including resetting the server admin password and changing firewall rules — but cannot manage their security policies.

This is a scope-level edge: it states that the principal holds a contributor-grade role over the SQL scope. The concrete abuse primitives that role unlocks — resetting the admin password, exporting data, or taking over via the Entra admin — are carried by the resource-level edges AZ_SQL_ACCESS and AZ_SQL_ADMIN, which fan out on their own from this assignment.

Owner and Contributor also grant everything SQL Server Contributor grants (via wildcard *), plus the ability to set the Microsoft Entra administrator (Microsoft.Sql/servers/administrators/write), which SQL Server Contributor does not hold.

Related edges: AZ_SQL_ACCESS, AZ_SQL_ADMIN.

Identification

PowerShell (Az Module)

Connect-AzAccount

# List SQL contributor-grade assignments
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @(
            "SQL Server Contributor"
        )
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Include broad roles at SQL scopes
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @("Owner", "Contributor") -and
        $_.Scope -match "/Microsoft.Sql/"
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

Azure Portal

1. Open Azure Portal -> target SQL server.

2. Go to Access control (IAM) -> Role assignments.

3. Filter for Owner, Contributor, SQL Server Contributor, and custom roles with Microsoft.Sql/servers/*.

4. Review inherited assignments from the resource group, subscription, and management group.

Exploitation

These examples are for authorized testing only.

Pivot to Management-Plane Abuse

Firewall changes and admin password resets are the direct exploitation paths available to SQL Server Contributor. For detailed exploitation steps, see AZ_SQL_ACCESS.

Pivot to Full Takeover

Where the assignment is Owner or Contributor (not the dedicated SQL Server Contributor role), the principal can also set itself as the server's Microsoft Entra administrator, gaining sysadmin-equivalent access to every database. For detailed exploitation steps, see AZ_SQL_ADMIN.

Mitigation

1. Reduce broad SQL roles - replace Owner/Contributor with the narrower SQL Server Contributor where full management access is not required.

2. Use Privileged Identity Management for temporary elevation to SQL Server Contributor.

3. Enable Microsoft Entra-only authentication to remove the admin-password-reset pivot to the data plane.

4. Restrict the network path with private endpoints and firewall rules, and monitor Microsoft.Sql/servers/firewallRules/write.

5. Monitor inherited assignments at subscription and resource-group scopes, not only direct SQL-scope assignments.

Detection

Use the Azure Portal:

1. Open Azure Portal -> target SQL server -> Activity log.

2. Review write operations against Microsoft.Sql/servers/*, especially admin-password resets and firewall rule changes.

3. Review Access control (IAM) for new or unexpected assignments of Owner, Contributor, or SQL Server Contributor.

4. Send Activity Log and Azure SQL Auditing logs to a SIEM and alert on configuration changes by unusual principals.

References

• Azure built-in roles for databases

• SQL Server Contributor built-in role

• Configure Microsoft Entra authentication for Azure SQL