Blog Post

Azure SQL Blog
9 MIN READ

Revamped SQL Permission system for Principle of Least Privilege and external policies – internals

AndreasWolter's avatar
AndreasWolter
Icon for Microsoft rankMicrosoft
Sep 27, 2022
If you have not read about it before, we recently made some deep changes within the permissions of SQL Server. The two most relevant announcements are here: New granular permissions for SQL Server ...
Updated Nov 23, 2022
Version 6.0
Azure SQL Security
Al_Howarth's avatar
Al_Howarth
Copper Contributor
Oct 06, 2022

AndreasWolter, I tried to address a security issue which required granting excessive rights, 4 years ago.

https://feedback.azure.com/d365community/idea/11c16a9b-5d25-ec11-b6e6-000d3a4f0da0

As you can see, it was immediately dismissed. But I think this warrants reviewing. SQLAgentOperatorRole doesn't grant full permissions to SQL Agent jobs. To grant this you must grant SysAdmin:

 

"Msg 14525, Level 16, State 1, Procedure msdb.dbo.sp_delete_job, Line 105 [Batch Start Line 2]
Only members of sysadmin role are allowed to update or delete jobs owned by a different login."