I'm going to start off apologizing since this is my first post and looking at other questions they don't quite match my own situation, also I'm a SysAdmin, not a DBA so my understanding of SQL is rusty and limited.
My organization frequently encounters vendors who in order for their application to run they do what we refer to as lazy programming and request SA credentials or demand that their custom account has sysadmin rights. My organization also has data protection/compliance policies which require us to grant only required access and rights.
Most recently a vendor that I am working with wants their account to be a sysadmin, but it actually only needs access to a single database. If we give the AD account (because their application only works with Windows Authentication) sysadmin rights I can use the application's GUI to browse and select the database, but if we only make that same account the DBOwner we can't find anything.
Is there a way to find out if it is trying to poll other databases or determine what the lowest level of rights needed for the required database(s) would be? When I tried asking the vendor I was told, "It requires sysadmin rights, but its ok because it only accesses the one database." Which isn't ok when it comes to our policies.
Thanks for any advice.