Cannot create new Role with postgres Flexible server

Hello Jérôme Villeneuve-Larouche,

Thanks for posting your question on Microsoft Q&A!

The error you are getting because of Azure Flexible Server does not expose full superuser privileges to customer accounts, even the admin user you created during server provisioning. That admin user is mapped to the built-in role azure_pg_admin, which has elevated privileges but does not include the ADMIN OPTION required to grant or manage other roles at the system level.

So when you run CREATE ROLE, PostgreSQL internally tries to assign ownership or default privileges, which triggers a check for the ADMIN OPTION something your admin user doesn’t have.

Check for more details on this document https://docs.azure.cn/en-us/postgresql/flexible-server/security-access-control

you can try this to work around the issue

Step 1: Create a new role

postgres=> CREATE ROLE newuser CREATEROLE CREATEDB INHERIT LOGIN PASSWORD 'xxxxx';

postgres=> \du admin <<yours>> -- check what are the list of roles and grant them to the new user like below.

Step 2: Grant all permissions that the Admin has to the new role

postgres=> GRANT pg_read_all_settings,pg_read_all_stats,pg_stat_scan_tables,azure_pg_admin  to newuser with ADMIN OPTION;

If you are getting same issue, try below approach

Use Azure RBAC for server-level permissions: Assign the Flexible Server Contributor role to your Azure AD user or group via the Azure Portal or CLI.

This controls access at the resource level, not inside PostgreSQL itself.

Please let us know if you are having further queries happy to assist you.

If the given information resolved your issue, kindly consider Upvote it will help others who might be facing similar challenges.

Thanks,

Kalyani

Thank you for the answer.

The first steps you proposed do not work, as I am unable to create any new role with the admin user.

Then, by RBAC, I assume you mean authenticating with Entra ID. So I enabled it and logged in postgres with my Azure user. This user can create a new role, but I'm unable to find a way to fix the original Admin user.

Fixing the original admin user is essential to us since it is the user we use in Terraform to provision all our clients' roles and databases.

Hi Jérôme Villeneuve-Larouche,

I understand your concern, but did you get a chance to try the first approach or are you assuming it might not work? Ideally, it should work in your case. If it still doesn’t, could you please share a screenshot so we can better guide you on the issue?

Thanks!

Kalyani