Skip to content

Commit ef5e78b

Browse files
markingmynamemarkingmyname
committed
improve acrolinx score
1 parent dcfc5fe commit ef5e78b

1 file changed

Lines changed: 79 additions & 78 deletions

File tree

‎includes/database-migration-service-sql-permissions.md‎

Lines changed: 79 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,69 @@
11
---
22
author: WilliamDAssafMSFT
33
ms.author: wiassaf
4+
ms.date: 03/30/2026
45
ms.service: azure-sql-database
56
ms.topic: include
6-
ms.date: 04/12/2023
77
---
88

9+
# Permissions required for SQL Server Assessment
10+
11+
The authentication method you use to connect to a source SQL Server instance needs certain minimal permissions to query the requisite information. The required permissions are as follows:
12+
13+
| Database | Permission | Objects |
14+
| --- | --- | --- |
15+
| `master` | CONNECT ANY DATABASE | |
16+
| `master` | SELECT | `sys.sql_expression_dependencies` |
17+
| `master` | EXECUTE | `sys.xp_regenumkeys` |
18+
| `master` | VIEW DATABASE STATE | |
19+
| `master` | VIEW SERVER STATE | |
20+
| `master` | VIEW ANY DEFINITION | |
21+
| `msdb` | EXECUTE | dbo.agent_datetime |
22+
| `msdb` | SELECT | dbo.sysjobsteps |
23+
| `msdb` | SELECT | dbo.syssubsystems |
24+
| `msdb` | SELECT | dbo.sysjobhistory |
25+
| `msdb` | SELECT | dbo.syscategories |
26+
| `msdb` | SELECT | dbo.sysjobs |
27+
| `msdb` | SELECT | dbo.sysmaintplan_plans |
28+
| `msdb` | SELECT | dbo.syscollector_collection_sets |
29+
| `msdb` | SELECT | dbo.sysmail_profile |
30+
| `msdb` | SELECT | dbo.sysmail_profileaccount |
31+
| `msdb` | SELECT | dbo.sysmail_account |
32+
| All User Databases | VIEW DATABASE STATE | |
33+
| All User Databases | SELECT | `sys.sql_expression_dependencies` |
934

10-
# Permissions required for SQL Server Assessment
11-
The login used to connect to a source SQL Server instance needs certain minimal permissions to query the requisite information. The required permissions are as follows:
12-
13-
|Database|Permission|Object(s)|
14-
|-|-|-|
15-
|master|CONNECT ANY DATABASE||
16-
|master|SELECT|sys.sql_expression_dependencies|
17-
|master|EXECUTE|sys.xp_regenumkeys|
18-
|master|VIEW DATABASE STATE||
19-
|master|VIEW SERVER STATE||
20-
|master|VIEW ANY DEFINITION||
21-
|msdb|EXECUTE|dbo.agent_datetime|
22-
|msdb|SELECT|dbo.sysjobsteps|
23-
|msdb|SELECT|dbo.syssubsystems|
24-
|msdb|SELECT|dbo.sysjobhistory|
25-
|msdb|SELECT|dbo.syscategories|
26-
|msdb|SELECT|dbo.sysjobs|
27-
|msdb|SELECT|dbo.sysmaintplan_plans|
28-
|msdb|SELECT|dbo.syscollector_collection_sets|
29-
|msdb|SELECT|dbo.sysmail_profile|
30-
|msdb|SELECT|dbo.sysmail_profileaccount|
31-
|msdb|SELECT|dbo.sysmail_account|
32-
|All User Databases|VIEW DATABASE STATE||
33-
|All User Databases|SELECT|sys.sql_expression_dependencies|
34-
3535
## Special considerations for Always On Availability Groups
36-
For SQL Server instances that host availability group replicas, it's recommended to provision a Windows Domain account with required permissions for assessment.
37-
38-
When SQL Server Authentication or a local Windows login is used, mismatched SIDs can prevent the custom login from resolving on the other replicas of the Always On Availability Group. To prevent this issue, after the login is created on the first of all the instances that host an Always On Availability Group, note the SID of the login created. Provide this SID as a parameter when creating the login in the instances hosting the remaining replicas of the Always On Availability Group.
39-
40-
## Configure the custom login for Assessment
4136

42-
The following are sample scripts for creating a login and provisioning it with the necessary permissions.
37+
For SQL Server instances that host availability group replicas, provision a Windows domain account with the required permissions for assessment.
38+
39+
When you use SQL Server Authentication or a local Windows authentication, mismatched SIDs can prevent the custom authentication from resolving on the other replicas of the Always On Availability Group. To prevent this problem, after you create the authentication on the first instance that hosts an Always On Availability Group, note the SID of the authentication. Provide this SID as a parameter when creating the authentication in the instances hosting the remaining replicas of the Always On Availability Group.
40+
41+
## Configure the custom authentication for assessment
42+
43+
The following sample scripts show how to create an authentication and grant it the necessary permissions.
44+
45+
### Windows Authentication
4346

44-
### Windows Authentication
45-
4647
```sql
4748
-- Create a login to run the assessment
4849
use master;
49-
-- If a SID needs to be specified, add here
50+
-- If a SID needs to be specified, add here
5051
DECLARE @SID NVARCHAR(MAX) = N'';
5152
CREATE LOGIN [MYDOMAIN\MYACCOUNT] FROM WINDOWS;
52-
SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'MYDOMAIN\MYACCOUNT'
53-
IF (ISNULL(@SID,'') != '')
54-
PRINT N'Created login [MYDOMAIN\MYACCOUNT] with SID = ' + @SID
55-
ELSE
56-
PRINT N'Login creation failed'
57-
GO
58-
59-
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
53+
SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'MYDOMAIN\MYACCOUNT'
54+
IF (ISNULL(@SID,'') != '')
55+
PRINT N'Created login [MYDOMAIN\MYACCOUNT] with SID = ' + @SID
56+
ELSE
57+
PRINT N'Login creation failed'
58+
GO
59+
60+
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
6061
use master;
6162
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY CREATE USER [MYDOMAIN\MYACCOUNT] FOR LOGIN [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
6263
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
6364
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT VIEW DATABASE STATE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
6465
GO
65-
66+
6667
-- Provide server level read-only permissions
6768
use master;
6869
BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
@@ -71,12 +72,12 @@ The following are sample scripts for creating a login and provisioning it with t
7172
BEGIN TRY GRANT VIEW SERVER STATE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
7273
BEGIN TRY GRANT VIEW ANY DEFINITION TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
7374
GO
74-
75+
7576
-- Required from SQL 2014 onwards for database connectivity.
7677
use master;
7778
BEGIN TRY GRANT CONNECT ANY DATABASE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
7879
GO
79-
80+
8081
-- Provide msdb specific permissions
8182
use msdb;
8283
BEGIN TRY GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
@@ -91,7 +92,7 @@ The following are sample scripts for creating a login and provisioning it with t
9192
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
9293
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
9394
GO
94-
95+
9596
-- Clean up
9697
--use master;
9798
-- EXECUTE sp_MSforeachdb 'USE [?]; BEGIN TRY DROP USER [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;'
@@ -100,37 +101,37 @@ The following are sample scripts for creating a login and provisioning it with t
100101
```
101102

102103
### SQL Server Authentication
103-
104+
104105
```sql
105106
-- Create a login to run the assessment
106107
use master;
107-
-- If a SID needs to be specified, add here
108+
-- If a SID needs to be specified, add here
108109
DECLARE @SID NVARCHAR(MAX) = N'';
109-
IF (@SID = N'')
110-
BEGIN
111-
CREATE LOGIN [evaluator]
112-
WITH PASSWORD = '<provide a strong password>'
113-
END
114-
ELSE
115-
BEGIN
116-
CREATE LOGIN [evaluator]
117-
WITH PASSWORD = '<provide a strong password>'
118-
, SID = @SID
119-
END
120-
SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'evaluator'
121-
IF (ISNULL(@SID,'') != '')
122-
PRINT N'Created login [evaluator] with SID = '+@SID
123-
ELSE
124-
PRINT N'Login creation failed'
125-
GO
126-
127-
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
110+
IF (@SID = N'')
111+
BEGIN
112+
CREATE LOGIN [evaluator]
113+
WITH PASSWORD = '<provide a strong password>'
114+
END
115+
ELSE
116+
BEGIN
117+
CREATE LOGIN [evaluator]
118+
WITH PASSWORD = '<provide a strong password>'
119+
, SID = @SID
120+
END
121+
SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'evaluator'
122+
IF (ISNULL(@SID,'') != '')
123+
PRINT N'Created login [evaluator] with SID = '+@SID
124+
ELSE
125+
PRINT N'Login creation failed'
126+
GO
127+
128+
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
128129
use master;
129130
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY CREATE USER [evaluator] FOR LOGIN [evaluator]END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
130131
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator]END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
131132
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT VIEW DATABASE STATE TO [evaluator]END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
132133
GO
133-
134+
134135
-- Provide server level read-only permissions
135136
use master;
136137
BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
@@ -139,12 +140,12 @@ The following are sample scripts for creating a login and provisioning it with t
139140
BEGIN TRY GRANT VIEW SERVER STATE TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
140141
BEGIN TRY GRANT VIEW ANY DEFINITION TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
141142
GO
142-
143+
143144
-- Required from SQL 2014 onwards for database connectivity.
144145
use master;
145146
BEGIN TRY GRANT CONNECT ANY DATABASE TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
146147
GO
147-
148+
148149
-- Provide msdb specific permissions
149150
use msdb;
150151
BEGIN TRY GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
@@ -159,7 +160,7 @@ The following are sample scripts for creating a login and provisioning it with t
159160
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
160161
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
161162
GO
162-
163+
163164
-- Clean up
164165
--use master;
165166
-- EXECUTE sp_MSforeachdb 'USE [?]; BEGIN TRY DROP USER [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;'
@@ -169,12 +170,12 @@ The following are sample scripts for creating a login and provisioning it with t
169170

170171
## How to use the permissions script
171172

172-
The permissions script can be used as follows:
173+
Use the permissions script as follows:
173174

174-
- Save the appropriate permissions script (with valid password string) as an _.sql_ file, say _c:\workspace\MinPermissions.sql_
175-
- Connect to the instance(s) using an account with sysadmin permissions and execute the script. You can use **SQL Server Management Studio** or **sqlcmd**. The following example uses a trusted connection.
175+
- Save the appropriate permissions script (with a valid password string) as a _.sql_ file, such as _c:\workspace\MinPermissions.sql_.
176+
- Connect to the instances by using an account with sysadmin permissions and run the script. You can use SQL Server Management Studio or **sqlcmd**. The following example uses a trusted connection.
176177

177-
```cmd
178-
sqlcmd.exe -S sourceserver\sourceinstance -d master -E -i c:\workspace\MinPermissions.sql
179-
```
178+
```cmd
179+
sqlcmd.exe -S sourceserver\sourceinstance -d master -E -i c:\workspace\MinPermissions.sql
180+
```
180181
- Use the minimal permissions account for further connections.

0 commit comments

Comments
 (0)