DENY overrides GRANT, and an inherited DENY even overrides a direct GRANT. And a DENY at the schema or database level overrides a GRANT at the object level. So you won't be able to directly override the DENY. You can create a view, synonym, or stored procedure owned by the same user as SuperSecretData and grant them access to that. is there a better ...


Sensitivity classification is a feature of SSMS rather than SQL Server. Based on SSMS suggestions in Data Sensitivity & Classification Wizard you might decide to change your data model. Beside, Aron's article, there is mine too. So, check Data Discovery & Classification in SQL Server which might help you


Just found the answer: Create SQL login with minimal privileges Execute function from source database under that user (WITH EXECUTE AS) Module sign object GRANT AUTHENTICATE to user created from certificate (this is the one I missed)

Only top voted, non community-wiki answers of a minimum length are eligible