I have a schema called
training. I want users who will be trained to have CRUD permissions on any object on that schema. I do not want them to have any other permissions on any other object outside that schema, and I also do not want them to have create/drop permissions for the schema itself. What is the least permissions to grant this type of access?
Currently, I set up the schema
training with dbo as the owner. Then I created a role called
training_modify and added the
training schema as a securable with "Select", "Update", "Insert", and "Delete" explicitly granted. Finally, I will add users to that role.
Is this the right approach? Does it have any unintended consequences?