I'm using SQL Server 2016 for these tests.
The following did not allow me to create a table in schema S for user U
USE [D];
GRANT CONTROL ON SCHEMA :: [S] TO [U];
But this did:
USE [D]
GRANT ALTER ON SCHEMA :: [S] TO [U];
GRANT CREATE TABLE TO [U];
What is the GRANT CONTROL supposed to do, if you have to run these two additional commands to allow the user to create a table in a specific schema?
This description is nice, but what kind of a use case can I run that can confirm (with success or failure) the GRANT CONTROL command physically affected the user's security on the database with and without this schema, before and after running the command?
CONTROL permission: The CONTROL permission can be used to easily grant all permissions on an entity to some principal. It's the next best thing after ownership of the entity, but it's not quite as powerful as ownership. The main difference is that a grantee of CONTROL can still be denied some other permissions on the entity. For example, I can be granted CONTROL on a table, while at the same time I can be denied SELECT on that table, preventing me from selecting from it - this can never happen to the owner, because the owner cannot be granted or denied permissions.