I'm working on behalf of a client who has granted me access to their Umbraco Cloud database/Azure SQL Server instance via the Umbraco admin > Connection > IP Adddresses/connection string. Now I want to create a read only database user for Umbraco Cloud v8. How can I do this? I tried connecting to the master database but I received an error:

Cannot open server '<server>' requested by the login. Client with IP address '37.***.***.***' is not allowed to access the server.  To enable access, use the Azure Management Portal or run sp_set_firewall_rule on the master database to create a firewall rule for this IP address or address range.  It may take up to five minutes for this change to take effect.

I assume if it's hosted cloud umbraco I can't get to the Azure portal?

That's a level of granularity that would be covered in the Azure Portal but not in the Umbraco Cloud Portal that your client would have access to. The Azure portal will of course be accessible to the Cloud support team. I think then the way forward here would be for you (or your client) to raise a support ticket through the Umbraco Cloud portal and ask them to connect to the database on your behalf and run a SQL script you have provided to create the desired user/credentials.