Forum Discussion
Entity Framework DB permissions
I want to use Entity Framework with a .Net 9 app but have had difficulty finding information on what DB permissions it needs in the app database.
I've found a couple old StackOverflow posts but having created a user with the recommended db_datareader, db_datawriter and db_ddladmin and updated the app connection string to use it and now the app won't start.
What more does it need?
1 Reply
Hi, what I think is
The reason you can't find an official Microsoft page called "EF Core Database Permissions" is because Entity Framework doesn't actually have its own permissions. EF just translates C# into SQL, so its database requirements depend entirely on what your code is trying to do.
If your app won't start with reader, writer, and ddladmin, it is almost certainly because of one of two things:
First, if your code uses context.Database.EnsureCreated() or tries to apply migrations when the database doesn't even exist yet, your user needs database-level creation rights. DDLAdmin is not enough to create a database from scratch; you would need the dbcreator server role or CREATE DATABASE permissions.
Second, if the database already exists but you are running migrations at startup, EF needs to write to the system table called __EFMigrationsHistory. While ddladmin lets EF create the table, it doesn't give permission to insert rows into it. You have to make sure your migration user also has db_datawriter and db_datareader permissions mapped to that specific database.
For reference, Microsoft's official stance in their security documentation is that you should separate your concerns. They recommend using a high-privilege connection string (like db_owner) temporarily in your deployment pipeline to run migrations, and then switching the actual running app to a low-privilege connection string that only has db_datareader and db_datawriter.
