0

What is the difference between having only the db_owner database role and having all other except db_denydatareader and db_denydatawriter?

db_securityadmin + db_accessadmin + db_backupoperator + db_ddladmin + db_datareader + db_datawriter

Versus

db_owner

I've read that when you have db_accessadmin and db_securityadmin roles, you can change database role of another user into the database but I tried and it seems that I don't have the permission to change any permission while logged with this user. But if I give to this user the db_owner role, now I can change permission to any other user.

Improve this question
2
  • Both of your cases above have db_owner, though. db_owner > db_securityadmin. db_securityadmin can modify role membership for custom roles only.
    – S3S
    Jul 25 '19 at 20:34
  • Hummm, sorry I really missed while creating a use case and taking screenshots; the first picture should not have the db_owner checked. I will modify my screenshot as soon as possible. Thanks!
    – Samuel
    Jul 25 '19 at 20:58
3

As per the Docs article, db_owner can perform functions that no other role or combination of roles provides, including but not limited to:

  • Adding users to fixed-database roles
  • Dropping the database
  • The CONTROL DATABASE permission

There is a diagram on the linked article that shows the fixed-role permissions for each role. Any permission not listed in that diagram is granted to the db_owner role only by default.

Improve this answer
0
0

The description here will show you exactly what the differences are.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.