Azure Database for PostgreSQL
An Azure managed PostgreSQL database service for app development and deployment.
1,410 questions
Postgres version upgrade: Broken user/role management after upgrade to v16
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 74%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAH%3C/text%3E%3C/svg%3E)
Alexander Harrington
0
Reputation points
Hello, I am having issues with my Postgres instance (Azure Flexible Server for Postgres).
After the upgrade from V12 to V16 (more specifically, the issue stems from the upgrade to V16), we lost the ability to modify existing users and roles in our database - but we can still create new users and roles. We have received support on this issue before, but the issue has persisted / regressed.
When attempting to modify any existing user or role, we get the error message from Postgres:
ERROR: permission denied to grant role 'role_x' Detail: Only roles with the ADMIN option on role 'user_a' may grant this role.
The issue is reportedly known by Microsoft, as it was a bug introduced by their handling of the vX-to-v16 migration (confirmed by support personnel in first round of support, as well as in below link).
We only have a developer support plan, and the generic MS support from admin.microsoft.com is not able to help, because it is too technical. However, given that the issue was introduced by MS itself, I expect adequate support regardless of our support plan.
Azure Database for PostgreSQL
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 60%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMK%3C/text%3E%3C/svg%3E)
Mahesh Kurva 4,555 Reputation points Microsoft External Staff Moderator2025-06-13T09:14:59.3333333+00:00 I kindly request you to please share the details requested in the private message, which will help us to address your query.
-
Alexander Harrington 0 Reputation points
2025-06-13T09:20:22.0833333+00:00 Thank you for the very quick response. I will follow up in private messages :)
-
Mahesh Kurva 4,555 Reputation points Microsoft External Staff Moderator
2025-06-13T09:35:23.69+00:00 Thanks for sharing the details.
ERROR: permission denied to grant role 'role_x' Detail: Only roles with the ADMIN option on role 'user_a' may grant this role.
In v16:
- A user must have the
ADMIN OPTIONon a role in order to grant or revoke membership in that role.
CREATEROLEalone no longer allows this.- A user with
CREATEROLEcan still create users but can only drop users they created themselves.
For more information, please refer the document:
PostgreSQL 16 changes with role based security.
I hope this information helps. Please do let us know if you have any further queries.
- A user must have the
-
Alexander Harrington 0 Reputation points
2025-06-13T10:14:29.3266667+00:00 Hello again Mahesh. I am aware of this change, but the issue is for our root user of the instance, listed in the Azure portal. This user was supposed to have admin rights over the DB and only be used for admin-related tasks, but since the upgrade, it lost the ability to manage existing users and roles. It can, however, create new roles.
As mentioned, it was a regression introduced by the v12-to-v16 upgrade being improperly rolled out by Microsoft (as per https://learn.microsoft.com/en-us/answers/questions/1835378/can-not-manage-roles-in-v16-that-where-created-in and our contact with personnel about a year ago), so it will require closer support from you guys.
Sign in to comment
Sign in to answer