Why is Azure setting a specific security group as the owner of any new Postgres database created via Azure when its not the server admin, nor the user creating the database

David Hirst 0

Title says it all really.

Why is a database created on Azure for Postgress flexible not setting the Owner as the server user nor the user who is creating the database but some arbitrary security group. There is nothing in the Azure UI that shows any relation between this group and the server outside of being an owner on the subscription.

Adithya Prasad K 10 Reputation points Microsoft External Staff

2025-03-07T16:28:16.16+00:00

Hi David Hirst,
Thank you for reaching out and posting the query.
When you create a PostgreSQL database in Azure, the ownership and permissions can sometimes be managed differently than in traditional on-premises setups. Here are a few reasons why you might see an arbitrary security group set as the owner of the database:

Role-Based Access Control (RBAC): Azure uses RBAC to manage access to resources. If a security group is set as the owner, it may be part of a broader strategy to manage permissions at scale. This allows multiple users within that group to have the necessary permissions without needing to assign them individually.

Default Behavior: Azure may have default behaviors for certain configurations. If the database is created through a specific method (like an automated deployment or a template), it might default to using a security group for ownership.

Security Practices: Using a security group can enhance security by limiting direct access to the database. Instead of giving individual users access, you can manage access through the group, making it easier to add or remove users as needed.

Subscription Ownership: If the security group is tied to the subscription, it may be that the group has been granted permissions that allow it to manage resources, including databases. This can sometimes lead to unexpected ownership assignments.

Azure Policies: There may be Azure policies in place that dictate how resources are created and managed, including ownership settings.

If you need to change the owner of the database or understand the specific permissions and roles assigned, you can use SQL commands to check the current roles and permissions or modify them as needed.
I would request you to refer the below mentioned links for more information
https://learn.microsoft.com/en-us/previous-versions/azure/postgresql/single-server/concepts-security
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/quickstart-create-connect-server-vnet
https://learn.microsoft.com/en-us/azure/role-based-access-control/overview
https://learn.microsoft.com/en-us/azure/postgresql/

I hope this information helps. Please do let us know if you have any further queries.
Adithya Prasad K 10 Reputation points Microsoft External Staff

2025-03-10T03:34:15.9333333+00:00

Hi David Hirst,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Share via

Why is Azure setting a specific security group as the owner of any new Postgres database created via Azure when its not the server admin, nor the user creating the database

Your answer