topic Re: SQL Server Privileges for ArcGIS Server Service Account in ArcGIS Enterprise Questions

SQL Server Privileges for ArcGIS Server Service Account

ACrateau — Tue, 29 Nov 2022 00:10:06 GMT

I'm setting up a geodatabase using SQL Server to be a registered data store with an ArcGIS Enterprise site.

What privileges does the ArcGIS Server service account need to be granted on the database in order to host data from this database?

I've seen from other posts that the server acct needs read/write access to data being referenced. Can we utilize the built-in roles db_datareader and db_datawriter to accomplish this for all datasets in the GDB? Are there any other considerations when publishing branch-versioned data?

Re: SQL Server Privileges for ArcGIS Server Service Account

BillFox — Tue, 29 Nov 2022 00:05:49 GMT

yes, that will work to be able to view and edit with editor tracking using regular versioning

Re: SQL Server Privileges for ArcGIS Server Service Account

Scott_Tansley — Tue, 29 Nov 2022 02:51:55 GMT

Personally, I'm a bit of a security zealot. If you assign db_datawriter on the 'database' then all feature classes are editable by the ArcGIS Server user. You may have 100 feature classes in the database, but only 'say' 5 are intended to be editable via Feature Services. That potentially leaves 95 feature classes that are potentially editable from the web. That makes me uncomfortable.

Oftentimes, to ease administration I'll use db_datareader for the ArcGIS Server account. Then for editable services, I'll use a SQL user and specifically set the permissions layer by layer in the Change Privileges tool.

Obviously, it all depends on how risk-averse you are and the types of datasets you hold, but I tend to steer toward the side of caution. I also prefer to explicitly set view permissions in the same way, rather than using in buildt roles, but its often a compromise on what the clients needs are.

Just a thought.

Re: SQL Server Privileges for ArcGIS Server Service Account

Tim_Shapiro — Fri, 18 Apr 2025 20:44:10 GMT

Scott - how do you add built-in Portal accounts as a SQL User to set permissions by layer for feature service editing?