Oracle Cloud Infrastructure Documentation

Managing Access to Oracle Database@Azure

Learn about the policies, groups and roles used to manage access to Oracle Database@Azure. Using these groups and roles ensures that assigned users have the appropriate permissions to operate the service.

Groups and roles in Azure

Use the following groups in your Azure account.

Exadata Groups and Roles

Azure Group name Azure Role assignment Purpose
odbaa-exa-infra-administrators Oracle.Database Exadata Infrastructure Administrator This group is for administrators who need to manage all Exadata Database Service resources in Azure. Users with this role have all the permissions granted by "odbaa-vm-cluster-administrators".
odbaa-vm-cluster-administrators Oracle.Database VmCluster Administrator This group is for administrators who need to manage VM cluster resources in Azure.
odbaa-db-family-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage all Oracle Database Service resources in OCI.
odbaa-db-family-readers Oracle.Database Reader

This group is replicated in OCI during the optional identity federation process.

This group is for readers who need to view all Oracle Database resources in OCI.
odbaa-exa-cdb-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage all CDB resources in OCI.
odbaa-exa-pdb-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage all PDB resources in OCI.
odbaa-network-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage all network resources in OCI.
odbaa-costmgmt-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage cost and billing resources in OCI.

Autonomous Database Groups and Roles

Azure Group name Azure Role assignment Purpose
odbaa-adbs-db-administrators

Oracle.Database Autonomous Database Administrator

 This group is for administrators who need to manage all Oracle Autonomous Database resources in Azure.
odbaa-db-family-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage all Oracle Database Service resources in OCI.
odbaa-db-family-readers Oracle.Database Reader

This group is replicated in OCI during the optional identity federation process.

This group is for readers who need to view all Oracle Database resources in OCI.
odbaa-network-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage all network resources in OCI.
odbaa-costmgmt-administrators NONE

This group is replicated in OCI during the optional identity federation process.

This group is for administrators who need to manage cost and billing resources in OCI.

Groups in Oracle Cloud Infrastructure

Use the following groups in your Oracle Cloud Infrastructure (OCI) tenancy.

Group name Description

odbaa-db-family-administrators

Group to manage DB family actions

odbaa-db-family-readers

Group to read DB family actions

odbaa-exa-cdb-administrators

Group to manage Oracle Container Database (CDB) actions

odbaa-exa-pdb-administrators

Group to manage Oracle Pluggable Database (PDB) actions

See the following topics for more information:

Required OCI IAM Policies

The following IAM policies are needed for Oracle Database@Azure users or groups:

Allow any-user to use tag-namespaces in tenancy where request.principal.type = 'multicloudlink'
Allow any-user to manage tag-defaults in tenancy where request.principal.type = 'multicloudlink'

See Getting Started with Policies for information on working with policies.

Policies Automatically Created in OCI During Onboarding

The onboarding process automatically creates a set of policies in OCI that lets the multicloud service and authorized user groups perform certain actions. The information on these policies is for reference only.

Important

These policies must not be changed or deleted. They're required to avoid operational issues in the multicloud environment.

The policies are created in two compartments: the root compartment and the base compartment for the multicloud service. The base compartment is automatically created in the OCI tenancy during onboarding. The base compartment is named MulticloudLink_ODBAA_<YYYYMMDDHHMMSS> (where YYYYMMDDHHMMSS is the compartment creation timestamp).

The following table lists the policies created automatically during onboarding.

Compartment Policy Unique Name Purpose
base MulticloudLink_Management_Policy Lets the mutlicloud service manage all multicloud resources in the base compartment.
root <UNIQUE_ID>_Authorization_Policies Lets the multicloud service and authorized user groups tag system resources and attach system networking resources.
root <UNIQUE_ID>_OCI_MCS_Policy Lets authorized user groups manage all multicloud resources in the base compartment.
root <UNIQUE_ID>-ODBAADbFamilyPolicy Lets authorized user groups perform database operations.
root <UNIQUE_ID>_Observability_Policy Lets the multicloud service perform observability operations.