Skip to content

Commit d0f85dd

Browse files
v-ksreedevanv-ksreedevan
committed
SQL permissions
1 parent 076f288 commit d0f85dd

File tree

2 files changed

+163
-54
lines changed

2 files changed

+163
-54
lines changed

‎articles/migrate/tutorial-assess-sql.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ In this tutorial, you learn how to:
2626
## Prerequisites
2727

2828
- If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/pricing/free-trial/) before you begin.
29-
29+
- Ensure you have the [necessary permissions](../../includes/database-migration-service-sql-permissions.md) to assess the SQL server instances.
3030
- Before you follow this tutorial to assess your SQL Server instances for migration to Azure SQL, make sure you've discovered the SQL instances you want to assess using the Azure Migrate appliance, [follow this tutorial](tutorial-discover-vmware.md).
3131
- If you want to try out this feature in an existing project, ensure that you have completed the [prerequisites](how-to-discover-sql-existing-project.md) in this article.
3232

‎includes/database-migration-service-sql-permissions.md

Lines changed: 162 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -6,64 +6,173 @@ ms.date: 12/19/2022
66
ms.author: ajithkr-ms
77
---
88

9-
The login used to connect to a source SQL Server instance requires certain minimal permissions to query the requisite information. The following script shows creation of a SQL Server login with the requisite permissions.
109

10+
# Permissions required for SQL Server Assessment
11+
The login used to connect to a source SQL Server instance needs certain minimal permissions to query the requisite information. The required permissions are as follows:
12+
13+
|Database|Permission|Object(s)|
14+
|-|-|-|
15+
|master|CONNECT ANY DATABASE||
16+
|master|SELECT|sys.sql_expression_dependencies|
17+
|master|EXECUTE|sys.xp_regenumkeys|
18+
|master|VIEW DATABASE STATE||
19+
|master|VIEW SERVER STATE||
20+
|master|VIEW ANY DEFINITION||
21+
|msdb|EXECUTE|dbo.agent_datetime|
22+
|msdb|SELECT|dbo.sysjobsteps|
23+
|msdb|SELECT|dbo.syssubsystems|
24+
|msdb|SELECT|dbo.sysjobhistory|
25+
|msdb|SELECT|dbo.syscategories|
26+
|msdb|SELECT|dbo.sysjobs|
27+
|msdb|SELECT|dbo.sysmaintplan_plans|
28+
|msdb|SELECT|dbo.syscollector_collection_sets|
29+
|msdb|SELECT|dbo.sysmail_profile|
30+
|msdb|SELECT|dbo.sysmail_profileaccount|
31+
|msdb|SELECT|dbo.sysmail_account|
32+
|All User Databases|VIEW DATABASE STATE||
33+
|All User Databases|SELECT|sys.sql_expression_dependencies|
34+
35+
## Special considerations for Always On Avalability Groups
36+
For SQL Server instances that host availability group replicas, it's recommended to provision a Windows Domain accounts with required permissions for assessment.
37+
38+
When SQL Server Authentication or a local Windows login is used, mismatched SIDs can prevent the custom login from resolving on the other replicas of the Always On Availability Group. To prevent this issue, after the login is created on the first of all the instances that hosts an Always On Availability Group, note the SID of the login so created. Provide this SID as a parameter when creating the login in the instances hosting the remaining replicas of the Always On Availability Group.
39+
40+
## Configure the custom login for Assessment
41+
The following are example scripts that show creation of a login and provisioning it with the requisite permissions.
42+
43+
### Windows Authentication
44+
45+
```sql
46+
-- Create a login to run the assessment
47+
use master;
48+
-- If a SID needs to be specified, add here
49+
DECLARE @SID NVARCHAR(MAX) = N'';
50+
CREATE LOGIN [MYDOMAIN\MYACCOUNT] FROM WINDOWS;
51+
SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'MYDOMAIN\MYACCOUNT'
52+
IF (ISNULL(@SID,'') != '')
53+
PRINT N'Created login [MYDOMAIN\MYACCOUNT] with SID = ' + @SID
54+
ELSE
55+
PRINT N'Login creation failed'
56+
GO
57+
58+
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
59+
use master;
60+
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY CREATE USER [MYDOMAIN\MYACCOUNT] FOR LOGIN [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
61+
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
62+
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT VIEW DATABASE STATE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
63+
GO
64+
65+
-- Provide server level read-only permissions
66+
use master;
67+
BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
68+
BEGIN TRY GRANT EXECUTE ON OBJECT::sys.xp_regenumkeys TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
69+
BEGIN TRY GRANT VIEW DATABASE STATE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
70+
BEGIN TRY GRANT VIEW SERVER STATE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
71+
BEGIN TRY GRANT VIEW ANY DEFINITION TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
72+
GO
73+
74+
-- Required from SQL 2014 onwards for database connectivity.
75+
use master;
76+
BEGIN TRY GRANT CONNECT ANY DATABASE TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
77+
GO
78+
79+
-- Provide msdb specific permissions
80+
use msdb;
81+
BEGIN TRY GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
82+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysjobsteps] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
83+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[syssubsystems] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
84+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysjobhistory] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
85+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[syscategories] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
86+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysjobs] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
87+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmaintplan_plans] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
88+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[syscollector_collection_sets] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
89+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_profile] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
90+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
91+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
92+
GO
93+
94+
-- Clean up
95+
--use master;
96+
-- EXECUTE sp_MSforeachdb 'USE [?]; BEGIN TRY DROP USER [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;'
97+
-- BEGIN TRY DROP LOGIN [MYDOMAIN\MYACCOUNT] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
98+
--GO
99+
```
100+
101+
### SQL Server Authentication
102+
11103
```sql
12-
-- Create a login to run the assessment
13-
use master;
14-
CREATE LOGIN [evaluator]
15-
WITH PASSWORD = '<provide a strong password>'
16-
GO
17-
18-
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
19-
use master;
20-
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) CREATE USER [evaluator] FOR LOGIN [evaluator]'
21-
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator]'
22-
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) GRANT VIEW DATABASE STATE TO [evaluator]'
23-
GO
24-
25-
-- Provide server level read-only permissions
26-
use master;
27-
GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator]
28-
GRANT EXECUTE ON OBJECT::sys.xp_regenumkeys TO [evaluator];
29-
GRANT VIEW DATABASE STATE TO evaluator
30-
GRANT VIEW SERVER STATE TO evaluator
31-
GRANT VIEW ANY DEFINITION TO evaluator
32-
GO
33-
34-
-- Required from SQL 2014 onwards for database connectivity.
35-
use master;
36-
GRANT CONNECT ANY DATABASE TO evaluator
37-
GO
38-
39-
-- Provide msdb specific permissions
40-
use msdb;
41-
GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [evaluator]
42-
GRANT SELECT ON [msdb].[dbo].[sysjobsteps] TO [evaluator]
43-
GRANT SELECT ON [msdb].[dbo].[syssubsystems] TO [evaluator]
44-
GRANT SELECT ON [msdb].[dbo].[sysjobhistory] TO [evaluator]
45-
GRANT SELECT ON [msdb].[dbo].[syscategories] TO [evaluator]
46-
GRANT SELECT ON [msdb].[dbo].[sysjobs] TO [evaluator]
47-
GRANT SELECT ON [msdb].[dbo].[sysmaintplan_plans] TO [evaluator]
48-
GRANT SELECT ON [msdb].[dbo].[syscollector_collection_sets] TO [evaluator]
49-
GRANT SELECT ON [msdb].[dbo].[sysmail_profile] TO [evaluator]
50-
GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [evaluator]
51-
GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [evaluator]
52-
GO
53-
54-
-- Clean up
55-
--use master;
56-
-- EXECUTE sp_MSforeachdb 'USE [?]; DROP USER [evaluator]'
57-
-- DROP LOGIN [evaluator]
58-
--GO
104+
-- Create a login to run the assessment
105+
use master;
106+
-- If a SID needs to be specified, add here
107+
DECLARE @SID NVARCHAR(MAX) = N'';
108+
IF (@SID = N'')
109+
BEGIN
110+
CREATE LOGIN [evaluator]
111+
WITH PASSWORD = '<provide a strong password>'
112+
END
113+
ELSE
114+
BEGIN
115+
CREATE LOGIN [evaluator]
116+
WITH PASSWORD = '<provide a strong password>'
117+
, SID = @SID
118+
END
119+
SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'evaluator'
120+
IF (ISNULL(@SID,'') != '')
121+
PRINT N'Created login [evaluator] with SID = '+@SID
122+
ELSE
123+
PRINT N'Login creation failed'
124+
GO
125+
126+
-- Create user in every database other than tempdb and model and provide minimal read-only permissions.
127+
use master;
128+
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY CREATE USER [evaluator] FOR LOGIN [evaluator]END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
129+
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator]END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
130+
EXECUTE sp_MSforeachdb 'USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN TRY GRANT VIEW DATABASE STATE TO [evaluator]END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH'
131+
GO
132+
133+
-- Provide server level read-only permissions
134+
use master;
135+
BEGIN TRY GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
136+
BEGIN TRY GRANT EXECUTE ON OBJECT::sys.xp_regenumkeys TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
137+
BEGIN TRY GRANT VIEW DATABASE STATE TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
138+
BEGIN TRY GRANT VIEW SERVER STATE TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
139+
BEGIN TRY GRANT VIEW ANY DEFINITION TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
140+
GO
141+
142+
-- Required from SQL 2014 onwards for database connectivity.
143+
use master;
144+
BEGIN TRY GRANT CONNECT ANY DATABASE TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
145+
GO
146+
147+
-- Provide msdb specific permissions
148+
use msdb;
149+
BEGIN TRY GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
150+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysjobsteps] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
151+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[syssubsystems] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
152+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysjobhistory] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
153+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[syscategories] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
154+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysjobs] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
155+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmaintplan_plans] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
156+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[syscollector_collection_sets] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
157+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_profile] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
158+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
159+
BEGIN TRY GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
160+
GO
161+
162+
-- Clean up
163+
--use master;
164+
-- EXECUTE sp_MSforeachdb 'USE [?]; BEGIN TRY DROP USER [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;'
165+
-- BEGIN TRY DROP LOGIN [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;
166+
--GO
59167
```
60168

61-
Here's how the permissions script can be used:
169+
## How to use the permissions script
170+
171+
The script above can be used as follows:
172+
- Save the appropriate permissions script (with valid password string) as an _.sql_ file, say _c:\workspace\MinPermissions.sql_
173+
- Connect to the instance(s) using an account with sysadmin permissions and execute the script. You can use **SQL Server Management Studio** or **sqlcmd**. The following example uses a trusted connection.
62174

63-
- Save the permissions script (with valid password string) as an _.sql_ file, say _c:\workspace\MinPermissions.sql_
64-
- Connect to the instance(s) using an account with sysadmin permissions and execute the script. You can use **SQL Server Management Studio** or **sqlcmd**. The following example uses a trusted connection.
65175
```cmd
66176
sqlcmd.exe -S sourceserver\sourceinstance -d master -E -i c:\workspace\MinPermissions.sql
67177
```
68-
- Use the minimal permissions account so created for further connections.
69-
178+
- Use the minimal permissions account so created for further connections.

0 commit comments

Comments
 (0)