I'm setting up a database audit. I'd like to capture any DML change that is issued by database user other than the service account related to the application.
In short, this is to prove to our external auditors that no users are tampering with data outside of the application.
This following script sets up a DML audit that is global to all principles.
CREATE DATABASE AUDIT SPECIFICATION [OurDatabaseAuditSpec]
FOR SERVER AUDIT [OurAudit]
ADD (DELETE ON OBJECT::[dbo].[SensitiveData] BY [public]),
ADD (INSERT ON OBJECT::[dbo].[SensitiveData] BY [public]),
ADD (UPDATE ON OBJECT::[dbo].[SensitiveData] BY [public])
WITH (STATE = ON)
GO
How do I go about modifying this audit specification to capture everything EXCEPT what is being done by the application service account?
Am I limited to specifying each principle individually or can I specify an exception? Reading through BOL it seems I can only list principles to audit - not principles to ignore.