SQL Server Audit Specification

You can scope many database audit actions to a principal inside the specification. The T-SQL form is an action on a securable followed by BY principal, for example SELECT ON DATABASE::YourDatabase BY YourUser. Supported combinations depend on the action and securable, so script and test the specification rather than assuming every action group supports principal scoping.

For server action groups or cases that cannot use BY, add a predicate to SERVER AUDIT using a supported field such as server_principal_name. That predicate affects everything written to the audit, so use a separate audit target when other specifications must remain unfiltered.

Identity fields can differ because of EXECUTE AS, contained users, application roles, or pooling. Capture an unfiltered sample first and determine whether server_principal_name, database_principal_name, session_server_principal_name, or original_login_name identifies the sessions. Then apply the narrow filter and verify both matching and nonmatching users before relying on it for compliance