What is the difference between having only the db_owner database role and having all other except db_denydatareader and db_denydatawriter?
db_securityadmin + db_accessadmin + db_backupoperator + db_ddladmin + db_datareader + db_datawriter
Versus
db_owner
I've read that when you have db_accessadmin and db_securityadmin roles, you can change database role of another user into the database but I tried and it seems that I don't have the permission to change any permission while logged with this user. But if I give to this user the db_owner role, now I can change permission to any other user.
db_owner > db_securityadmin
. db_securityadmin can modify role membership for custom roles only. – scsimon Jul 25 '19 at 20:34