Add CLR CAS note to more articles

Author: rwestMSFT

docs/relational-databases/clr-integration/assemblies-designing.md

@@ -3,7 +3,7 @@ title: "Designing Assemblies"
 description: This article describes factors to consider when you design an assembly to host on SQL Server, including packaging, managing, and restrictions on assemblies.
 author: rwestMSFT
 ms.author: randolphwest
-ms.date: 12/27/2024
+ms.date: 07/23/2025
 ms.service: sql
 ms.subservice: clr
 ms.topic: "reference"
@@ -31,6 +31,10 @@ When you're packaging code into assembly, consider:
 
 - If a piece of managed code requires higher permission, it's better to separate that code into a separate assembly from code that doesn't require higher permission.
 
+## Code access security no longer supported
+
+[!INCLUDE [code-access-security](../../database-engine/includes/code-access-security.md)]
+
 ## Manage assembly security
 
 You can control how much an assembly can access resources protected by .NET Code Access Security when it runs managed code. You do this by specifying one of three permission sets when you create or modify an assembly: `SAFE`, `EXTERNAL_ACCESS`, or `UNSAFE`.
@@ -45,7 +49,7 @@ Most assemblies perform computation and data management tasks without having to
 
 `EXTERNAL_ACCESS` allows for assemblies to access certain external system resources such as files, networks, Web services, environmental variables, and the registry. Only [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] logins with `EXTERNAL ACCESS` permissions can create `EXTERNAL_ACCESS` assemblies.
 
-SAFE and `EXTERNAL_ACCESS` assemblies can contain only code that is verifiably type-safe. This means that these assemblies can only access classes through well-defined entry points that are valid for the type definition. Therefore, they can't arbitrarily access memory buffers not owned by the code. Additionally, they can't perform operations that might have an adverse effect on the robustness of the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] process.
+`SAFE` and `EXTERNAL_ACCESS` assemblies can contain only code that is verifiably type-safe. This means that these assemblies can only access classes through well-defined entry points that are valid for the type definition. Therefore, they can't arbitrarily access memory buffers not owned by the code. Additionally, they can't perform operations that might have an adverse effect on the robustness of the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] process.
 
 ### UNSAFE permission
 

docs/relational-databases/clr-integration/assemblies/creating-an-assembly.md

@@ -3,7 +3,7 @@ title: Create an Assembly
 description: Use CREATE ASSEMBLY to register an assembly in SQL Server and specify its security settings. Register an assembly to use its functionality.
 author: rwestMSFT
 ms.author: randolphwest
-ms.date: 12/27/2024
+ms.date: 07/23/2025
 ms.service: sql
 ms.subservice: clr
 ms.topic: "reference"
@@ -21,6 +21,10 @@ helpviewer_keywords:
 
 Managed database objects, such as stored procedures or triggers, are compiled and then deployed in units called an assembly. Managed DLL assemblies must be registered in [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] before the functionality the assembly provides can be used. To register an assembly in a [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] database, use the `CREATE ASSEMBLY` statement. This article discusses how to register an assembly in a database using the `CREATE ASSEMBLY` statement, and how to specify the security settings for the assembly.
 
+## Code access security no longer supported
+
+[!INCLUDE [code-access-security](../../../database-engine/includes/code-access-security.md)]
+
 ## The CREATE ASSEMBLY statement
 
 The `CREATE ASSEMBLY` statement is used to create an assembly in a database. Here's an example:
@@ -138,5 +142,5 @@ For more information about the permissions for each of the settings, see [CLR in
 - [Manage CLR integration assemblies](managing-clr-integration-assemblies.md)
 - [Alter an assembly](altering-an-assembly.md)
 - [Drop an assembly](dropping-an-assembly.md)
-- [CLR integration Code Access Security](../security/clr-integration-code-access-security.md)
+- [CLR integration code access security](../security/clr-integration-code-access-security.md)
 - [TRUSTWORTHY database property](../../security/trustworthy-database-property.md)

docs/relational-databases/clr-integration/assemblies/managing-clr-integration-assemblies.md

@@ -3,7 +3,7 @@ title: Manage CLR Integration Assemblies
 description: You can host managed DLL assemblies in SQL Server. You can register, alter, and drop assemblies, and also manage associated files and permissions.
 author: rwestMSFT
 ms.author: randolphwest
-ms.date: 12/27/2024
+ms.date: 07/23/2025
 ms.service: sql
 ms.subservice: clr
 ms.topic: "reference"
@@ -37,7 +37,11 @@ Assembly information is stored in the `sys.assembly_files` table in the database
 | [Alter an assembly](altering-an-assembly.md) | Describes updating CLR assemblies in [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] |
 | [Drop an assembly](dropping-an-assembly.md) | Discusses dropping CLR assemblies from [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] |
 
+## Code access security no longer supported
+
+[!INCLUDE [code-access-security](../../../database-engine/includes/code-access-security.md)]
+
 ## Related content
 
 - [CLR integration security](../security/clr-integration-security.md)
-- [CLR integration Code Access Security](../security/clr-integration-code-access-security.md)
+- [CLR integration code access security](../security/clr-integration-code-access-security.md)

docs/relational-databases/clr-integration/database-objects/clr-integration-programming-model-restrictions.md

@@ -3,7 +3,7 @@ title: CLR Integration Programming Model Restrictions
 description: SQL Server performs code checks on managed database objects when first registered using CREATE ASSEMBLY and at runtime.
 author: rwestMSFT
 ms.author: randolphwest
-ms.date: 12/27/2024
+ms.date: 07/23/2025
 ms.service: sql
 ms.subservice: clr
 ms.topic: "reference"
@@ -21,10 +21,14 @@ When you build a managed stored procedure or other managed database object, [!IN
 
 These code checks provide flexibility for registering third-party assemblies especially, so that an assembly isn't blocked where there's *unsafe* code designed to run in a client environment, but would never be executed in the hosted common language runtime (CLR). The requirements that the managed code must meet depend on whether the assembly is registered as `SAFE`, `EXTERNAL_ACCESS`, or `UNSAFE`. `SAFE` is the strictest security level.
 
-In addition to restrictions being placed on the managed code assemblies, there are also code security permissions that are granted. The CLR supports a security model called code access security (CAS) for managed code. In this model, permissions are granted to assemblies based on the identity of the code. `SAFE`, `EXTERNAL_ACCESS`, and `UNSAFE` assemblies have different CAS permissions. For more information, see [CLR integration Code Access Security](../security/clr-integration-code-access-security.md).
+In addition to restrictions being placed on the managed code assemblies, there are also code security permissions that are granted. The CLR supports a security model called code access security (CAS) for managed code. In this model, permissions are granted to assemblies based on the identity of the code. `SAFE`, `EXTERNAL_ACCESS`, and `UNSAFE` assemblies have different CAS permissions. For more information, see [CLR integration code access security](../security/clr-integration-code-access-security.md).
 
 If the [publisher policy](/dotnet/framework/configure-apps/how-to-create-a-publisher-policy) is set, `CREATE ASSEMBLY` fails.
 
+## Code access security no longer supported
+
+[!INCLUDE [code-access-security](../../../database-engine/includes/code-access-security.md)]
+
 ## CREATE ASSEMBLY checks
 
 When the `CREATE ASSEMBLY` statement runs, the following checks are performed for each security level. If any check fails, `CREATE ASSEMBLY` fails with an error message.
@@ -105,6 +109,6 @@ All `EXTERNAL_ACCESS` conditions are checked.
 ## Related content
 
 - [Supported .NET Framework libraries](supported-net-framework-libraries.md)
-- [CLR integration Code Access Security](../security/clr-integration-code-access-security.md)
+- [CLR integration code access security](../security/clr-integration-code-access-security.md)
 - [Host protection attributes and CLR integration programming](../../clr-integration-security-host-protection-attributes/host-protection-attributes-and-clr-integration-programming.md)
 - [Create an assembly](../assemblies/creating-an-assembly.md)

docs/relational-databases/clr-integration/security/clr-integration-code-access-security.md

@@ -3,7 +3,7 @@ title: CLR Integration Code Access Security
 description: For SQL Server CLR integration, CLR supports code access security for managed code, where permissions are granted to assemblies based on code identity.
 author: rwestMSFT
 ms.author: randolphwest
-ms.date: 12/27/2024
+ms.date: 07/23/2025
 ms.service: sql
 ms.subservice: clr
 ms.topic: "reference"
@@ -15,7 +15,7 @@ helpviewer_keywords:
   - "code access security [CLR integration]"
   - "EXTERNAL_ACCESS assemblies"
 ---
-# CLR integration Code Access Security
+# CLR integration code access security
 
 [!INCLUDE [SQL Server](../../../includes/applies-to-version/sqlserver.md)]
 
@@ -33,6 +33,10 @@ The code access security mechanism supported by the CLR is based on the assumpti
 
 The set of code access security permissions that are granted to managed code when running inside [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] is the intersection of the set of permissions granted by the previous three policy levels. Even if [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] grants a set of permissions to an assembly loaded in [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)], the eventual set of permissions given to user code might be further restricted by the user and machine-level policies.
 
+## Code access security no longer supported
+
+[!INCLUDE [code-access-security](../../../database-engine/includes/code-access-security.md)]
+
 ## SQL Server host policy level permission sets
 
 The set of code access security permissions granted to assemblies by the [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] host policy level is determined by the permission set specified when creating the assembly. There are three permission sets: `SAFE`, `EXTERNAL_ACCESS`, and `UNSAFE` (specified using the `PERMISSION_SET` option of [CREATE ASSEMBLY](../../../t-sql/statements/create-assembly-transact-sql.md)).

docs/t-sql/statements/create-assembly-transact-sql.md

@@ -4,7 +4,7 @@ description: CREATE ASSEMBLY creates a managed application module that contains
 author: markingmyname
 ms.author: maghan
 ms.reviewer: randolphwest
-ms.date: 08/02/2024
+ms.date: 07/23/2025
 ms.service: sql
 ms.subservice: t-sql
 ms.topic: reference
@@ -97,11 +97,11 @@ We recommend using `SAFE`. `SAFE` is the most restrictive permission set. Code e
 > [!NOTE]  
 > The `EXTERNAL_ACCESS` and `UNSAFE` options aren't available in a contained database.
 
-We recommend using `EXTERNAL_ACCESS` for assemblies that access resources outside of an instance of [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)]. `EXTERNAL_ACCESS` assemblies include the reliability and scalability protections of `SAFE` assemblies, but from a security perspective, are similar to `UNSAFE` assemblies. Code in `EXTERNAL_ACCESS` assemblies runs by default under the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] service account, and accesses external resources under that account, unless the code explicitly impersonates the caller. Therefore, permission to create `EXTERNAL_ACCESS` assemblies should be granted only to logins that are trusted to run code under the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] service account. For more information about impersonation, see [CLR Integration Security](../../relational-databases/clr-integration/security/clr-integration-security.md).
+We recommend using `EXTERNAL_ACCESS` for assemblies that access resources outside of an instance of [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)]. `EXTERNAL_ACCESS` assemblies include the reliability and scalability protections of `SAFE` assemblies, but from a security perspective, are similar to `UNSAFE` assemblies. Code in `EXTERNAL_ACCESS` assemblies runs by default under the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] service account, and accesses external resources under that account, unless the code explicitly impersonates the caller. Therefore, permission to create `EXTERNAL_ACCESS` assemblies should be granted only to logins that are trusted to run code under the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] service account. For more information about impersonation, see [CLR integration security](../../relational-databases/clr-integration/security/clr-integration-security.md).
 
 Specifying `UNSAFE` enables the code in the assembly complete freedom to perform operations in the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] process space that can potentially compromise the robustness of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)]. `UNSAFE` assemblies can also potentially subvert the security system of either [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] or the common language runtime. `UNSAFE` permissions should be granted only to highly trusted assemblies. Only members of the **sysadmin** fixed server role can create and alter `UNSAFE` assemblies.
 
-For more information about assembly permission sets, see [Designing assemblies](../../relational-databases/clr-integration/assemblies-designing.md).
+For more information about assembly permission sets, see [Design assemblies](../../relational-databases/clr-integration/assemblies-designing.md).
 
 ## Code access security no longer supported
 
@@ -145,7 +145,7 @@ Besides the previous checks that are performed when `CREATE ASSEMBLY` executes,
 
 - For `SAFE` and `EXTERNAL_ACCESS` assemblies, any attempt to call [!INCLUDE [dnprdnshort](../../includes/dnprdnshort-md.md)] APIs that are annotated with certain HostProtectionAttributes fails.
 
-For more information, see [Designing assemblies](../../relational-databases/clr-integration/assemblies-designing.md).
+For more information, see [Design assemblies](../../relational-databases/clr-integration/assemblies-designing.md).
 
 ## Permissions
 
@@ -164,7 +164,7 @@ The following permissions required to create a CLR assembly when `CLR strict sec
   - The assembly is signed with a certificate or asymmetric key that has a corresponding login with the `UNSAFE ASSEMBLY` permission on the server. Signing the assembly is recommended.
   - The database has the `TRUSTWORTHY` property set to `ON`, and the database is owned by a login that has the `UNSAFE ASSEMBLY` permission on the server. This option isn't recommended.
 
-For more information about assembly permission sets, see [Designing assemblies](../../relational-databases/clr-integration/assemblies-designing.md).
+For more information about assembly permission sets, see [Design assemblies](../../relational-databases/clr-integration/assemblies-designing.md).
 
 ## Examples