Skip to content

Commit 999c6f5

Browse files
twright-msfttwright-msft
committed
Learn Editor: Update configure-windows-accounts-agent.md
1 parent 7d5f0bf commit 999c6f5

1 file changed

Lines changed: 97 additions & 53 deletions

File tree

‎docs/sql-server/azure-arc/configure-windows-accounts-agent.md‎

Lines changed: 97 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ Base key: `HKEY_LOCAL_MACHINE`
6161

6262
## Group permissions
6363

64-
`NT Service\SQLServerExtension` is added to Hybrid agent extension applications. Supports Azure Instance Metadata Service (IMDS) Handshake.
64+
`NT Service\SQLServerExtension` is added to Hybrid agent extension applications. This enables the Azure Instance Metadata Service (IMDS) handshake to retrieve the Machine resource managed identity token required to communicate to Azure data plane services such as the Data Processing Service (DPS) and the telemetry endpoint for billing usage, extension logs, and monitoring dashboard data collection.
6565

6666
## SQL permissions
6767

@@ -72,61 +72,105 @@ Base key: `HKEY_LOCAL_MACHINE`
7272

7373
The extension also grants permissions to instance and database objects as features are enabled. The table below provides details.
7474

75-
| Feature | Permission | Level | Requirement |
76-
| --- | --- | --- | --- |
77-
| **Default** | `VIEW DATABASE STATE` | Server level | Essential |
78-
| | `VIEW SERVER STATE` | Server level | Essential |
79-
| | `CONNECT SQL` | Server level | Essential |
80-
| **Database as a resource** | Default public role | Server level (This is granted by default to newly added logins) | Essential |
81-
| **Best practices assessment** | `VIEW ANY DEFINITION` | Server level | Feature dependent |
82-
| | `VIEW ANY DATABASE` | Server level | Feature dependent |
83-
| | `SELECT` | `master` | Feature dependent |
84-
| | `SELECT` | `msdb` | Feature dependent |
85-
| | `EXECUTE ON sys.xp_enumerrorlogs` | `master` | Feature dependent |
86-
| | `EXECUTE ON sys.xp_readerrorlog` | `master` | Feature dependent |
87-
| **Backup** | `CREATE ANY DATABASE` | Server level | Feature dependent |
88-
| | **db_backupoperator** role | All databases | Feature dependent |
89-
| | **dbcreator** | Server role | Feature dependent |
90-
| **Azure Control Plane** | `CREATE TABLE` | `msdb` | Essential |
91-
| | `ALTER ANY SCHEMA` | `msdb` | Essential |
92-
| | `CREATE TYPE` | `msdb` | Essential |
93-
| | `EXECUTE` | `msdb` | Essential |
94-
| | **db_datawriter** role | `msdb` | Feature dependent |
95-
| | **db_datareader** role | `msdb` | Feature dependent |
96-
| **Availability group discovery** | `VIEW ANY DEFINITION` | Server level | Essential |
97-
| **Purview** | `SELECT` | All databases | Feature dependent |
98-
| | `EXECUTE` | All databases | Feature dependent |
99-
| | `CONNECT ANY DATABASE` | Server level | Feature dependent |
100-
| | `VIEW ANY DATABASE` | Server level | Feature dependent |
101-
| **Monitoring** | `SELECT dbo.sysjobactivity` | `msdb` | Essential |
102-
| | `SELECT dbo.sysjobs` | `msdb` | Essential |
103-
| | `SELECT dbo.syssessions` | `msdb` | Essential |
104-
| | `SELECT dbo.sysjobHistory` | `msdb` | Essential |
105-
| | `SELECT dbo.sysjobSteps` | `msdb` | Essential |
106-
| | `SELECT dbo.syscategories` | `msdb` | Essential |
107-
| | `SELECT dbo.sysoperators` | `msdb` | Essential |
108-
| | `SELECT dbo.suspectpages` | `msdb` | Essential |
109-
| | `SELECT dbo.backupset` | `msdb` | Essential |
110-
| | `SELECT dbo.backupmediaset` | `msdb` | Essential |
111-
| | `SELECT dbo.backupmediafamily` | `msdb` | Essential |
112-
| | `SELECT dbo.backupfile` | `msdb` | Essential |
113-
| | `CONNECT ANY DATABASE` | Server level | Essential |
114-
| | `VIEW ANY DATABASE` | Server level | Essential |
115-
| | `VIEW ANY DEFINITION` | Server level | Essential |
116-
| **Migration Assessment** | `EXECUTE dbo.agent_datetime` | `msdb` | Essential |
117-
| | `SELECT dbo.syscategories` | `msdb` | Essential |
118-
| | `SELECT dbo.sysjobHistory` | `msdb` | Essential |
119-
| | `SELECT dbo.sysjobs` | `msdb` | Essential |
120-
| | `SELECT dbo.sysjobSteps` | `msdb` | Essential |
121-
| | `SELECT dbo.sysmail_account` | `msdb` | Essential |
122-
| | `SELECT dbo.sysmail_profile` | `msdb` | Essential |
123-
| | `SELECT dbo.sysmail_profileaccount` | `msdb` | Essential |
124-
| | `SELECT dbo.syssubsystems` | `msdb` | Essential |
125-
| | `SELECT sys.sql_expression_dependencies` | All databases | Essential |
126-
12775
> [!NOTE]
12876
> Minimum permissions depend on enabled features. Permissions are updated when they are no longer necessary. Necessary permissions are granted when features are enabled.
12977
78+
## SQL Privileges by Feature
79+
80+
### Minimum System Requirements
81+
82+
These permissions are required for the basic level of functionality provided by the Azure Extension for SQL Server and must be applied.
83+
84+
| Object Type | Database or Object Name | Privilege |
85+
| ----------- | ---------------------- | ------------------------------ |
86+
| Database | Master | `VIEW DATABASE STATE` |
87+
| Database | Msdb | `ALTER ANY SCHEMA` |
88+
| Database | Msdb | `CREATE TABLE` |
89+
| Database | Msdb | `CREATE TYPE` |
90+
| Database | Msdb | `DB DATA READER` |
91+
| Database | Msdb | `DB DATA WRITER` |
92+
| Database | Msdb | `EXECUTE` |
93+
| Database | Msdb | `SELECT dbo.backupfile` |
94+
| Database | Msdb | `SELECT dbo.backupmediaset` |
95+
| Database | Msdb | `SELECT dbo.backupmediafamily` |
96+
| Database | Msdb | `SELECT dbo.backupset` |
97+
| Database | Msdb | `SELECT dbo.syscategories` |
98+
| Database | Msdb | `SELECT dbo.sysjobactivity` |
99+
| Database | Msdb | `SELECT dbo.sysjobhistory` |
100+
| Database | Msdb | `SELECT dbo.sysjobs` |
101+
| Database | Msdb | `SELECT dbo.sysjobsteps` |
102+
| Database | Msdb | `SELECT dbo.syssessions` |
103+
| Database | Msdb | `SELECT dbo.sysoperators` |
104+
| Database | Msdb | `SELECT dbo.suspectpages` |
105+
| Server | | `CONNECT ANY DATABASE` |
106+
| Server | | `CONNECT SQL` |
107+
| Server | | `VIEW ANY DATABASE` |
108+
| Server | | `VIEW ANY DEFINITION` |
109+
| Server | | `VIEW SERVER STATE` |
110+
111+
### Best Practices Assessment
112+
113+
The best practices assessment is disabled by default. If it is enabled, these permissions will be automatically granted if they are not already granted.
114+
115+
| Object Type | Database or Object Name | Privilege |
116+
| --------------- | ---------------------- | --------------------- |
117+
| Database | Master | `SELECT` |
118+
| Database | Master | `VIEW DATABASE STATE` |
119+
| Database | Msdb | `SELECT` |
120+
| Server | | `VIEW ANY DATABASE` |
121+
| Server | | `VIEW ANY DEFINITION` |
122+
| Server | | `VIEW SERVER STATE` |
123+
| StoredProcedure | EnumErrorLogsSP | `EXECUTE` |
124+
| StoredProcedure | ReadErrorLogsSP | `EXECUTE` |
125+
126+
### Backup
127+
128+
Automated backups are disabled by default. Backup permissions will be granted to any database that backups are enabled for. Enabling the backup feature also enables the point-in-time restore feature, so the permission to create a database is also granted.
129+
130+
| Object Type | Database or Object Name | Privilege |
131+
| ----------- | ---------------------- | --------------------- |
132+
| Database | All Databases | `DB BACKUP OPERATOR` |
133+
| Server | | `CREATE ANY DATABASE` |
134+
| Server | Master | `DB CREATOR` |
135+
136+
### Availability Groups
137+
138+
Availability Group discovery and management features such as failing over are enabled by default, but they can be disabled through the `AvailabilityGroupDiscovery` feature flag.
139+
140+
| Object Type | Database or Object Name | Privilege |
141+
| ----------- | ---------------------- | ------------------------------ |
142+
| Server | | `ALTER ANY AVAILABILITY GROUP` |
143+
| Server | | `VIEW ANY DEFINITION` |
144+
145+
### Purview
146+
147+
The Purview features are disabled by default.
148+
149+
| Object Type | Database or Object Name | Privilege |
150+
| ----------- | ---------------------- | ---------------------- |
151+
| Database | All Databases | `EXECUTE` |
152+
| Database | All Databases | `SELECT` |
153+
| Server | | `CONNECT ANY DATABASE` |
154+
| Server | | `VIEW ANY DATABASE` |
155+
156+
### Migration Assessment
157+
158+
Migration Assessments are enabled by default. If the feature is disabled, the permissions below will be removed unless other enabled features require them.
159+
160+
| Object Type | Database or Object Name | Privilege |
161+
| ----------- | ---------------------- | -------------------------------------- |
162+
| Database | All Databases | `SELECT sys.sqlexpressiondependencies` |
163+
| Database | Msdb | `EXECUTE dbo.agentdatetime` |
164+
| Database | Msdb | `SELECT dbo.syscategories` |
165+
| Database | Msdb | `SELECT dbo.sysjobhistory` |
166+
| Database | Msdb | `SELECT dbo.sysjobs` |
167+
| Database | Msdb | `SELECT dbo.sysjobsteps` |
168+
| Database | Msdb | `SELECT dbo.sysmailaccount` |
169+
| Database | Msdb | `SELECT dbo.sysmailprofile` |
170+
| Database | Msdb | `SELECT dbo.sysmailprofileaccount` |
171+
| Database | Msdb | `SELECT dbo.syssubsystems` |
172+
173+
130174
## Additional permissions
131175

132176
- Permissions to service account to access extension service and configure autorecovery.

0 commit comments

Comments
 (0)