Skip to content

Commit

Permalink
correctness
Browse files Browse the repository at this point in the history
  • Loading branch information
MikeRayMSFT committed Nov 7, 2024
1 parent ea0cdb9 commit b631127
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docs/sql-server/azure-arc/configure-least-privilege.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,15 +59,15 @@ As listed in prerequisites, the SQL Server service account must be a member of t
- Features are enabled or disabled
- SQL Server instances are added or removed

`Deployer.exe` impersonates the SQL Server service account to connect to SQL Server and add or remove permissions in server and database roles depending on which features are enabled or disabled to ensure that the Azure extension for SQL Server uses the least privileges required. To modify these permissions, the SQL Server service account be a member of the `sysadmin` server role.
`Deployer.exe` impersonates the SQL Server service account to connect to SQL Server and add or remove permissions in server and database roles depending on which features are enabled or disabled to ensure that the Azure extension for SQL Server uses the least privileges required. To modify these permissions, the SQL Server service account must be a member of the `sysadmin` server role.

If you want to manage this process with more control, such that the SQL Server service account is not a member of the sysadmin server role all the time, follow these steps:

1. Temporarily add the SQL Server service account to the sysadmin server role.
1. Allow `Deployer.exe` to run at least once so that the permissions are set.
1. Remove the SQL Server service account from the sysadmin role.

Repeat this procedure any time features are enabled or disabled or SQL Server instances are added to allow `Deployer.exe` to grant the least privileges required.
Repeat this procedure anytime features are enabled or disabled or SQL Server instances are added to allow `Deployer.exe` to grant the least privileges required.

### Tools

Expand Down

0 comments on commit b631127

Please sign in to comment.