[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# About SQL Server users\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/users \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/users \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page describes how Cloud SQL works with SQL Server users and roles. SQL\nServer roles enable you to control the access and capabilities of users who\naccess a SQL Server instance.\n\nFor information about creating and managing Cloud SQL users, see [Creating\nand managing users](/sql/docs/sqlserver/create-manage-users).\n| **Note:** See [Other SQL Server users](#other-users) for additional information about users you create using Cloud SQL.\n\nSQL Server roles and users\n--------------------------\n\nSQL Server roles can be a single role, or they can function as a group of roles.\n\nA user is a role with the ability to log in (the role has the `LOGIN`\npermission). All roles created by Cloud SQL have the `LOGIN` permission,\nso Cloud SQL uses the terms \"role\" and \"user\" interchangeably. However, if\nyou create a role with any client tool that is compatible with SQL Server, then\nthe role doesn't necessarily receive the `LOGIN` permission.\n\nCloud SQL for SQL Server restricts access to certain server roles that\nprovide advanced privileges. Examples of these roles are `DbRootRole`,\n`serveradmin`, `securityadmin`, `setupadmin`, `diskadmin`, and `dbcreator`.\n\nAll SQL Server users must have a password. Thus, you can't log in with a user\nthat lacks a password.\n\nSuperusers and system stored procedures\n---------------------------------------\n\nCloud SQL for SQL Server is a managed service, so it restricts access to certain\nsystem stored procedures and tables that require advanced privileges. In\nCloud SQL, you cannot create or have access to users with superuser\npermissions.\n| **Note:** The `sysadmin` role is not supported. Therefore, you cannot run system stored procedures that require the `sysadmin` role. As one of the many examples, you cannot run the `sp_OADestroy` stored procedure because it requires the `sysadmin` role.\n\nDefault SQL Server users\n------------------------\n\nWhen you create a new Cloud SQL for SQL Server instance, the default `sqlserver`\nuser is already created for you, although you must set its password.\n\nThe `sqlserver` user is part of the `CustomerDbRootRole` role, and its\npermissions (privileges) include the following:\n\n- `ALTER ANY CONNECTION`\n- `ALTER ANY LOGIN`\n- `ALTER ANY SERVER ROLE`\n- `ALTER SERVER STATE`\n- `ALTER TRACE`\n- `CONNECT SQL`\n- `CREATE ANY DATABASE`\n- `CREATE SERVER ROLE`\n- `VIEW ANY DATABASE`\n- `VIEW ANY DEFINITION`\n- `VIEW SERVER STATE`\n\nYou can also add [`cloudsql enable linked servers`](/sql/docs/sqlserver/linked-servers)\nto your instance if you want to use it with linked servers. This flag grants the\nfollowing permission to your server:\n\n- `ALTER ANY LINKED SERVER`\n\n| **Note:** Cloud SQL for SQL Server doesn't support the `sysadmin` and `dbcreator` roles. Therefore, due to unavailable permissions, automated schema deployment using a [DACPAC](https://docs.microsoft.com/en-us/sql/relational-databases/data-tier-applications/data-tier-applications?view=sql-server-ver16) isn't supported.\n\nGranting server permissions\n---------------------------\n\nWhen you grant privileges using any [`GRANT`\ncommand](https://docs.microsoft.com/sql/t-sql/statements/grant-server-permissions-transact-sql?view=sql-server-ver15),\nyou must pass `CustomerDbRootRole` as, for example, the value of\n`grantor_principal`.\n\nThe following `GRANT ALTER ANY LOGIN` example is **valid**: \n\n```sql\nGRANT ALTER ANY LOGIN TO [Account] AS CustomerDbRootRole\n```\n\nThe following `GRANT ALTER ANY LOGIN` example is **invalid**: \n\n```sql\nGRANT ALTER ANY LOGIN TO [Account]\n```\n\nOther SQL Server users\n----------------------\n\nYou can [create other SQL Server users](/sql/docs/sqlserver/create-manage-users) or roles. All users you\ncreate using Cloud SQL are granted the same database permissions as the\n`sqlserver` login. However, if you use a different process to create a user\n(rather than creating it using Cloud SQL), the user won't have the same\npermissions as the customer administrator accounts or the `sqlserver` user. For\nexample, if you use the [create\nlogin](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-login-transact-sql?view=sql-server-ver16)\nprocess, and add the login to the `CustomerDbRootRole` server role, the user\nwon't have the same permissions as the customer administrator accounts or the\n`sqlserver` user. Therefore, you can use Cloud SQL to create a user if you\nintend the user to have the same database permissions as the `sqlserver` login.\nTo validate the difference in permissions between any two accounts, you can use\nthe following function:\n[sys.fn_my_permissions](https://learn.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-my-permissions-transact-sql?view=sql-server-ver16).\n| **Note:** For reading audit files, Cloud SQL grants specific permissions to the `sqlserver` login, and that user can grant those permissions to other users. See [Creating server audits](/sql/docs/sqlserver/db-audit#creating-server-audits).\n\n### Database imports: owner permissions\n\nWhen you import a database, the treatment of the owner varies as follows, based\non the type of owner:\n\n- **For an existing login that isn't `sa`:** Cloud SQL keeps that owner and creates a user called `sqlserver` that maps to the login `sqlserver`. Cloud SQL grants the `CONTROL` and `ALTER ANY USER` permissions to that `sqlserver` user.\n- **For unknown logins, or logins that were system-created:** Cloud SQL transfers ownership of the database to the `sqlserver` login.\n\n### Changing permissions for users\n\nThe [ALTER\nROLE](https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-role-transact-sql)\ncommand is available for changing user permissions. If you create a new user\nwith a client, you can associate it with a different role or provide different\npermissions.\n\nTroubleshooting\n---------------\n\n### Error accessing database\n\nWhen trying to access to a database you created, as a user you created, you get\nthe following error: \n\n```sql\nThe server principal USERNAME is not able to access the\ndatabase DATABASE_NAME under the current security context.\n```\n\n#### The issue might be\n\nThe user is not a member of the database.\n\n#### Things to try\n\nConnect to the database as the `sqlserver` user and add the new user,\nthen [give the new user the `db_owner` role](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-addrolemember-transact-sql?view=sql-server-2017) for the database. For\nexample: \n\n```bash\nEXEC sp_adduser 'user';\nEXEC sp_addrolemember 'db_owner', 'user'\n```\n\nWhat's next\n-----------\n\n- [Configure the user for your instance](/sql/docs/sqlserver/create-manage-users#user-root).\n- [Create and manage users](/sql/docs/sqlserver/create-manage-users).\n- [Create and manage\n databases](/sql/docs/sqlserver/create-manage-databases)."]]
