Lets say I am defining AD Admin for my Azure SQL Server instance -- then isn't 'Server Admin' redundant? Because if I have AD Admin defined , I don't see what is the use for having server admin. And we can have an azure group be specified as AD Admin so we can't necessarily say that server admin exists as a stand by admin account in case AD admin leaves the organization, because precisely for that reason we can define azure group as AD Admin. Is there a way we can somehow remove (or not define) Server Admin?
1 Answers
It is not possible to remove or disable the SQL Server Admin. The mechanism that the Azure Subscription owners use to force their way into their own database is to reset the SQL Server Admin password from the Azure Portal.
The Azure Subscription Owner and the AAD SQL Admin identity have joint ownership of the Azure SQL Server. Either one needs to be able to re-acquire administrative access to the server.
One option you have is to assign the SQL Server Admin a strong password and forget about it. Do not use it and do not share it with anyone on the organization. Nobody will use it then.
Related