What is the difference between having only the db_owner database role and having all other except db_denydatareader and db_denydatawriter?

db_securityadmin + db_accessadmin + db_backupoperator + db_ddladmin + db_datareader + db_datawriter



I've read that when you have db_accessadmin and db_securityadmin roles, you can change database role of another user into the database but I tried and it seems that I don't have the permission to change any permission while logged with this user. But if I give to this user the db_owner role, now I can change permission to any other user.

  • Both of your cases above have db_owner, though. db_owner > db_securityadmin. db_securityadmin can modify role membership for custom roles only.
    – S3S
    Jul 25, 2019 at 20:34
  • Hummm, sorry I really missed while creating a use case and taking screenshots; the first picture should not have the db_owner checked. I will modify my screenshot as soon as possible. Thanks!
    – Samuel
    Jul 25, 2019 at 20:58

2 Answers 2


As per the Docs article, db_owner can perform functions that no other role or combination of roles provides, including but not limited to:

  • Adding users to fixed-database roles
  • Dropping the database
  • The CONTROL DATABASE permission

There is a diagram on the linked article (repeated below) that shows the fixed-role permissions for each role. Any permission not listed in that diagram is granted to the db_owner role only by default.

enter image description here


The description here will show you exactly what the differences are.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.