I agree with you, but in a multi database scenario, if we make a login sysadmin , he as the rights to view or edit other databases right [I am not talking about MrDoStuff login] but the main login for database? Not talking about sending mails alone.

@strutzky Last time I checked when I put MrDoStuff to sysadmin role, the certificate token were not propagated to inner stored procs in msdb. That is why I kept to alter settings, control server and alter any credential (mentioned in my second comment). But then suddenly I recognised mail with attachments were failing and had to revert back the original login to sysadmin . I will check again and get back to you with more clarity.

yes, I had to make the login a sysadmin which kind of sadly defeated the purpose, all the way going through creating certificates, If its a sysadmin role there is indeed no need of signed certificate because you are the god on the system right?

just to add if the mail you are sending l is having attachments then the above said method will fail, it requires access permissions using sysadmin role

I added the counter signature and it started working. I didn't add the user as sysadmin but gave permissions to alter settings, control server and alter any credential , because when I gave sysadmin I couldn't see user token of certificate being propagated to inner stored procs in msdb

Hi @srutzky, I followed the steps as you mentioned and added the user to sysadmin role, So when I execute the stored proc now I am getting :- User does not have permission to perform this action.(at the place where I call msdb update function for DbMail configuration). I believe I don't have to switch context because that was the whole point of going via certificate route ( the created login is mapped to msdb and database under question) having sysadmin role. Why should that error be appearing in that case?