I have couple of Active directory groups authenticated to access my RDS SQL Server instance. I have granted access to a AD group to perform ALTER ANY connection with GRANT.
When I log in as a user of that AD group and try to GRANT ALTER any connection the SQL stmt fails : GRANTOR does not have GRANT permission
But when I exclusively create a SQL login for the user in the group and give permission to that user and try the GRANT it works.
Is it supposed to work like that? If so, then what's the point of having a group? I'm not able to find any info on this. If you know any Microsoft document that explains this behavior it would be great.
Similar issue : AD User does not inherit the permission from AD Group - for a LOGIN