What is best practice for sql server security? Using AD groups that are given rights on schema objects or should I add the AD groups to a database role which is given rights on schema objects ? If the later one is best practice, what is really the benefit of using database roles ?
Generally speaking, adding AD groups to database roles and granting the permissions to the roles gives you some separation of purpose. In that case you would use them as:
- AD Group = a set of logins that share the same database access needs.
- Role = a set of permissions that define a set of rights to be shared by logins.
The advantage is that the role can have more that one AD group added to it. Likewise, if the AD Group is removed, the permission sets remain in place. That way the original AD Group, a new AD Group or groups, could be added without needing to redefine the rights.
And, of course, more than one AD Group can use a role and an AD Group could use several roles. It all depends on how you want to use and reuse permissions.
If the rights are granted directly to an AD Group, then dropping the group also drops the rights that the group had. Which would mean recreating those rights if you need them elsewhere.