Entity Framework DB permissions

Hi, what I think is

The reason you can't find an official Microsoft page called "EF Core Database Permissions" is because Entity Framework doesn't actually have its own permissions. EF just translates C# into SQL, so its database requirements depend entirely on what your code is trying to do.

If your app won't start with reader, writer, and ddladmin, it is almost certainly because of one of two things:

First, if your code uses context.Database.EnsureCreated() or tries to apply migrations when the database doesn't even exist yet, your user needs database-level creation rights. DDLAdmin is not enough to create a database from scratch; you would need the dbcreator server role or CREATE DATABASE permissions.

Second, if the database already exists but you are running migrations at startup, EF needs to write to the system table called __EFMigrationsHistory. While ddladmin lets EF create the table, it doesn't give permission to insert rows into it. You have to make sure your migration user also has db_datawriter and db_datareader permissions mapped to that specific database.

For reference, Microsoft's official stance in their security documentation is that you should separate your concerns. They recommend using a high-privilege connection string (like db_owner) temporarily in your deployment pipeline to run migrations, and then switching the actual running app to a low-privilege connection string that only has db_datareader and db_datawriter.