Cloud SQL for SQL Server は、高度な権限を提供する特定のサーバーロールに対するアクセスを制限します。これらのロールの例としては、DbRootRole、serveradmin、securityadmin、setupadmin、diskadmin、dbcreator などがあります。
すべての SQL Server ユーザーにはパスワードが必要です。パスワードが設定されていないユーザーはログインできません。
スーパーユーザーとシステム ストアド プロシージャ
Cloud SQL for SQL Server はマネージド サービスであるため、高度な権限を必要とする特定のシステム ストアド プロシージャとテーブルにアクセスを制限します。Cloud SQL では、スーパーユーザー権限を持つユーザーの作成やそのようなユーザーへのアクセスはできません。
デフォルトの SQL Server ユーザー
新しい Cloud SQL for SQL Server インスタンスを作成すると、デフォルトの sqlserver ユーザーが作成されますが、パスワードを設定する必要があります。
sa 以外の既存のログインの場合: Cloud SQL はそのオーナーを保持し、ログイン sqlserver にマッピングする sqlserver というユーザーを作成します。
Cloud SQL は、その sqlserver ユーザーに CONTROL 権限と ALTER ANY USER 権限を付与します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-03 UTC。"],[],[],null,["# About SQL Server users\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/users \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/users \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page describes how Cloud SQL works with SQL Server users and roles. SQL\nServer roles enable you to control the access and capabilities of users who\naccess a SQL Server instance.\n\nFor information about creating and managing Cloud SQL users, see [Creating\nand managing users](/sql/docs/sqlserver/create-manage-users).\n| **Note:** See [Other SQL Server users](#other-users) for additional information about users you create using Cloud SQL.\n\nSQL Server roles and users\n--------------------------\n\nSQL Server roles can be a single role, or they can function as a group of roles.\n\nA user is a role with the ability to log in (the role has the `LOGIN`\npermission). All roles created by Cloud SQL have the `LOGIN` permission,\nso Cloud SQL uses the terms \"role\" and \"user\" interchangeably. However, if\nyou create a role with any client tool that is compatible with SQL Server, then\nthe role doesn't necessarily receive the `LOGIN` permission.\n\nCloud SQL for SQL Server restricts access to certain server roles that\nprovide advanced privileges. Examples of these roles are `DbRootRole`,\n`serveradmin`, `securityadmin`, `setupadmin`, `diskadmin`, and `dbcreator`.\n\nAll SQL Server users must have a password. Thus, you can't log in with a user\nthat lacks a password.\n\nSuperusers and system stored procedures\n---------------------------------------\n\nCloud SQL for SQL Server is a managed service, so it restricts access to certain\nsystem stored procedures and tables that require advanced privileges. In\nCloud SQL, you cannot create or have access to users with superuser\npermissions.\n| **Note:** The `sysadmin` role is not supported. Therefore, you cannot run system stored procedures that require the `sysadmin` role. As one of the many examples, you cannot run the `sp_OADestroy` stored procedure because it requires the `sysadmin` role.\n\nDefault SQL Server users\n------------------------\n\nWhen you create a new Cloud SQL for SQL Server instance, the default `sqlserver`\nuser is already created for you, although you must set its password.\n\nThe `sqlserver` user is part of the `CustomerDbRootRole` role, and its\npermissions (privileges) include the following:\n\n- `ALTER ANY CONNECTION`\n- `ALTER ANY LOGIN`\n- `ALTER ANY SERVER ROLE`\n- `ALTER SERVER STATE`\n- `ALTER TRACE`\n- `CONNECT SQL`\n- `CREATE ANY DATABASE`\n- `CREATE SERVER ROLE`\n- `VIEW ANY DATABASE`\n- `VIEW ANY DEFINITION`\n- `VIEW SERVER STATE`\n\nYou can also add [`cloudsql enable linked servers`](/sql/docs/sqlserver/linked-servers)\nto your instance if you want to use it with linked servers. This flag grants the\nfollowing permission to your server:\n\n- `ALTER ANY LINKED SERVER`\n\n| **Note:** Cloud SQL for SQL Server doesn't support the `sysadmin` and `dbcreator` roles. Therefore, due to unavailable permissions, automated schema deployment using a [DACPAC](https://docs.microsoft.com/en-us/sql/relational-databases/data-tier-applications/data-tier-applications?view=sql-server-ver16) isn't supported.\n\nGranting server permissions\n---------------------------\n\nWhen you grant privileges using any [`GRANT`\ncommand](https://docs.microsoft.com/sql/t-sql/statements/grant-server-permissions-transact-sql?view=sql-server-ver15),\nyou must pass `CustomerDbRootRole` as, for example, the value of\n`grantor_principal`.\n\nThe following `GRANT ALTER ANY LOGIN` example is **valid**: \n\n```sql\nGRANT ALTER ANY LOGIN TO [Account] AS CustomerDbRootRole\n```\n\nThe following `GRANT ALTER ANY LOGIN` example is **invalid**: \n\n```sql\nGRANT ALTER ANY LOGIN TO [Account]\n```\n\nOther SQL Server users\n----------------------\n\nYou can [create other SQL Server users](/sql/docs/sqlserver/create-manage-users) or roles. All users you\ncreate using Cloud SQL are granted the same database permissions as the\n`sqlserver` login. However, if you use a different process to create a user\n(rather than creating it using Cloud SQL), the user won't have the same\npermissions as the customer administrator accounts or the `sqlserver` user. For\nexample, if you use the [create\nlogin](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-login-transact-sql?view=sql-server-ver16)\nprocess, and add the login to the `CustomerDbRootRole` server role, the user\nwon't have the same permissions as the customer administrator accounts or the\n`sqlserver` user. Therefore, you can use Cloud SQL to create a user if you\nintend the user to have the same database permissions as the `sqlserver` login.\nTo validate the difference in permissions between any two accounts, you can use\nthe following function:\n[sys.fn_my_permissions](https://learn.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-my-permissions-transact-sql?view=sql-server-ver16).\n| **Note:** For reading audit files, Cloud SQL grants specific permissions to the `sqlserver` login, and that user can grant those permissions to other users. See [Creating server audits](/sql/docs/sqlserver/db-audit#creating-server-audits).\n\n### Database imports: owner permissions\n\nWhen you import a database, the treatment of the owner varies as follows, based\non the type of owner:\n\n- **For an existing login that isn't `sa`:** Cloud SQL keeps that owner and creates a user called `sqlserver` that maps to the login `sqlserver`. Cloud SQL grants the `CONTROL` and `ALTER ANY USER` permissions to that `sqlserver` user.\n- **For unknown logins, or logins that were system-created:** Cloud SQL transfers ownership of the database to the `sqlserver` login.\n\n### Changing permissions for users\n\nThe [ALTER\nROLE](https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-role-transact-sql)\ncommand is available for changing user permissions. If you create a new user\nwith a client, you can associate it with a different role or provide different\npermissions.\n\nTroubleshooting\n---------------\n\n### Error accessing database\n\nWhen trying to access to a database you created, as a user you created, you get\nthe following error: \n\n```sql\nThe server principal USERNAME is not able to access the\ndatabase DATABASE_NAME under the current security context.\n```\n\n#### The issue might be\n\nThe user is not a member of the database.\n\n#### Things to try\n\nConnect to the database as the `sqlserver` user and add the new user,\nthen [give the new user the `db_owner` role](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-addrolemember-transact-sql?view=sql-server-2017) for the database. For\nexample: \n\n```bash\nEXEC sp_adduser 'user';\nEXEC sp_addrolemember 'db_owner', 'user'\n```\n\nWhat's next\n-----------\n\n- [Configure the user for your instance](/sql/docs/sqlserver/create-manage-users#user-root).\n- [Create and manage users](/sql/docs/sqlserver/create-manage-users).\n- [Create and manage\n databases](/sql/docs/sqlserver/create-manage-databases)."]]
