Prerequisites
This topic explains the prerequisites required to begin provisioning Oracle Database@Azure. During provisioning, many of the tasks you perform, requires specific permission. The following table provides details of the permissions you need to complete each task.
Note
The following notes are regarding to OCI IAM:
The following notes are regarding to OCI IAM:
- If the user is an OCI tenancy administrator, then no additional permissions are required for the steps outlined in the table below.
- If the user is not an OCI tenancy administrator, then user needs to be part of a group that has the required permissions described in the table below.
- During the onboarding process, some groups are automatically created with required polices, and you can add an user to those groups so that the user can perform the tasks.
- If you want to allow a different group to perform the tasks, then follow these steps below.
- Create a new group in the default domain, or use an existing group. For more information, see Creating a Group.
- Create a policy in the root compartment of the OCI tenancy with the required policy statements and add it to the group. For more information, see Creating a Policy.
- Add users to the group. For more information, see Adding Users to a Group.
Note
The following notes are regarding to Azure IAM:
The following notes are regarding to Azure IAM:
- If the user has a privileged administrator roles as Owner, then no additional permissions are required for the steps outlined in the table below. The user with Contributor roles can manage all resources however, the user can not assign roles in Azure RBAC. The User Access Administrator role in Azure is a dedicated privileged administrator role. It allows users to manage user access to Azure resources.
- If the user does not have the right privileged administrator roles, then user needs to have additional permissions and roles.
- The roles and permissions listed in the table below provide examples of the Azure IAM actions needed to assign the right permissions for Oracle Database@Azure.
- To create roles and assign them to a user or group, see create a custom role using Azure portal, Azure PowerShell, Azure CLI or REST API.
- To manage user roles with Microsoft Entra ID, see Assign user roles with Microsoft Entra ID and Use Microsoft Entra groups to manage role assignments.
- When you create roles using JSON template, you must replace
[Name]with the name of the role and[Actions]with the permissions you are granting.{ "Name": "Custom Network Role", "Id": null, "IsCustom": true, "Description": "Can manage VNets and Subnets including delegation", "Actions": [ "Microsoft.Network/virtualNetworks/*", "Microsoft.Network/virtualNetworks/subnets/*" ], "NotActions": [], "DataActions": [], "NotDataActions": [], "AssignableScopes": [ "/subscriptions/{subscription-id}" ] }
Note
Azure provides built-in roles for defined purposes, and custom roles can be created with a set of permissions. Azure allows assigning roles directly to users, but creating groups of users and assigning roles to the groups is recommended. For more information, see the Microsoft Entra RBAC documentation.
Azure provides built-in roles for defined purposes, and custom roles can be created with a set of permissions. Azure allows assigning roles directly to users, but creating groups of users and assigning roles to the groups is recommended. For more information, see the Microsoft Entra RBAC documentation.
Table 1-1 Oracle Database@Azure Resource Permissions by Task
| Task | Cloud | Persona | Permissions |
|---|---|---|---|
|
Azure | Network administrator |
Built-in role: Network Contributor |
|
Azure | Infrastructure administrator |
Built-in role: Oracle.Database Exadata Infrastructure Administrator |
|
Azure | Infrastructure administrator and Database administrator |
Built-in role: Oracle.Database VmCluster Administrator Built-in Role |
|
Azure | Infrastructure administrator and Database administrator |
Built-in role: Oracle.Database Exascale VmCluster Administrator |
|
Azure | Database administrator |
Built-in role: Oracle.Database Autonomous Database Administrator |
|
OCI | Database administrator |
OCI IAM: If the user is not an OCI tenancy administrator, then it needs to be part of the following pre-created groups:
|
|
Azure | Database administrator |
Built-in role: Oracle.Database DBSystems Administrator
|
|
OCI |
Built-in groups: If the user is not an OCI tenancy administrator, then it needs to be part of the following groups in OCI IAM:
Custom Policies:
|
For more information on how to grant the required permissions, see the following: