Scoped permissions
Use scoped permissions to alter permissions for a user or role on a database or schema scope.
Scoped permissions apply to objects in the selected scope when you grant or revoke the permission, as well as to new objects created after you grant or revoke the permission. For example, granting a role scoped permission to select from tables in a database lets users with that role select from tables that are created in the future, and also lets them select from tables that currently exist in the database.
You can use scoped permissions to set the default permissions on a shared database created from a datashare. A consumer-side datashare user who is granted scoped permissions on a shared database will automatically gain those permissions for any new object added to the datashare on the producer side.
For more information on applying scoped permissions, see GRANT and REVOKE.
Considerations for using scoped permissions
When using scoped permissions, consider the following:
-
You can use scoped permissions to grant permissions on a database or schema scope to a chosen user or role, or revoke them. You can’t grant scoped permissions to user groups, so you can’t revoke them.
-
Granting or revoking scoped permissions changes permissions for all current and future objects in the scope.
-
Scoped permissions apply independently of object-level permissions. They aren’t mutually exclusive. For example, consider a user who has object-level permission to a table, and also scoped permission for the schema that the table is in. In both of the following scenarios, the user retains access to the table.
-
The user’s scoped permission for the schema the table is in is revoked, but the user still has access to the table via object-level permission for the table.
-
The user’s object-level permission for the table is revoked, but the user still has access to the table via the scoped permission for the schema.
-
-
To grant or revoke scoped permissions, you must meet one of the following criteria:
-
Superusers.
-
Users with the grant option for that permission. For more information on grant options, see the WITH GRANT OPTION parameter in GRANT.
-
-
Scoped permissions can only be granted to or revoked from objects for the connected database, or from databases imported from a datashare.
-
You can grant scoped permissions that apply to databases created from datashares.