Say it with me… “Least privileges”. We don’t use the ##MS_DatabaseManager## role (or its twin db_creator), mostly because, well… …because I hold an unpopular opinion: Only DBAs should be able to create, much less assign ownership to, a database. I’ve got 99 problems, but this ain’t one. #SQL #SQLServer #DataArchitecture #DataSecurity
You probably missed this (I did, too): Privilege escalation vulnerability in SQL Server ##MS_DatabaseManager##-server role found. The doc was updated July 2025. (Updated from Oct as per Microsofts comment here on LinkedIn) (Link https://lnkd.in/gMi5ZeWc) The finder will publish the elevation path soon. For now, all you can do is to make sure you audit & check activities by members. Update: after further investigation I do not recommend using this role in security sensitive environments until there is a fix. See follow up articles
