We are trying to DENY the ALTER ANY DATABASE DDL TRIGGER permission to a login. This permission is listed in this Microsoft Doc.
But a testLogin that is also a user in one database, and has ALTER TABLE permission on TestTable, can still create a trigger on TestTable despite the fact that we ran the following T-SQL DENY statement successfully:
DENY ALTER ANY DATABASE DDL TRIGGER TO testLogin
As mentioned in this article (if you search for DENY ALTER ANY DATABASE DDL TRIGGER TO [Domain\User]) the above DENY statement should deny the testLogin to create a trigger on any database.
Question: what we may be doing wrong here and how can we fix the issue?
Remark: We are using an Azure SQL Managed Instance