Skip to content

Update configure-least-privilege.md #10320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hdharshana wants to merge 3 commits into from
Closed

Update configure-least-privilege.md #10320

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d7cb850
Update configure-least-privilege.md
hdharshana Apr 16, 2026
caae56a
Update docs/sql-server/azure-arc/configure-least-privilege.md
hdharshana Apr 17, 2026
b73130a
Add AI usage note to least privilege configuration guide
hdharshana Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion docs/sql-server/azure-arc/configure-least-privilege.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,11 @@ If you want to manage this process with more control, such that the SQL Server s

Repeat this procedure anytime features are enabled or disabled or SQL Server instances are added to allow `Deployer.exe` to grant the least privileges required.

> [!IMPORTANT]
> The Azure extension for SQL Server **Deployer** requires **NT AUTHORITY\SYSTEM** to be able to connect to SQL Server (with **CONNECT SQL** permission) in both **standard** and **least‑privilege** modes. This is because the Deployer always runs under the **LocalSystem** account, regardless of which service account is used by the extension after provisioning.
>
> If **NT AUTHORITY\SYSTEM** cannot connect to SQL Server, the Deployer cannot create the **NT SERVICE\SQLServerExtension** login or grant the required permissions. Before enabling least‑privilege mode, verify that **NT AUTHORITY\SYSTEM** has an active SQL Server login with **CONNECT SQL** permission. See **Prerequisites** for verification steps.
Comment thread
hdharshana marked this conversation as resolved.
Outdated
Comment thread
hdharshana marked this conversation as resolved.
Outdated
Comment thread
hdharshana marked this conversation as resolved.
Outdated

### Tools

To complete the steps in this article, you need the following tools:
Expand Down Expand Up @@ -160,4 +165,4 @@ To verify that your SQL Server enabled by Azure Arc is configured to run with le

- [Configure advanced data security for your SQL Server instance](configure-advanced-data-security.md)
- [Configure best practices assessment on a [!INCLUDE [ssazurearc](../../includes/ssazurearc.md)] instance](assess.md)
- [Known issues: SQL Server enabled by Azure Arc](known-issues.md)
- [Known issues: SQL Server enabled by Azure Arc](known-issues.md)
Comment thread
hdharshana marked this conversation as resolved.