Contained user permissions

Question

I have an azure hosted SQL database per customer. The customer is set up as a contained user to their own database with the following permissions (ALTER, CONTROL, DELETE, EXECUTE, INSERT, SELECT, UPDATE, CONNECT, VIEW DATABASE STATE).

I don't mind the customer making any changes to their database schema, but is it possible to make any changes to the logical server or access any other databases on the same server? Is the main security risk the customer creating other users on their database?

https://docs.microsoft.com/en-us/sql/relational-databases/databases/security-best-practices-with-contained-databases?view=sql-server-2017

Thanks in advance.

Answer 1

If your database user is not created base on a logical server login,you don't have the permission to access multiple databases.

Please reference: Controlling and granting database access to SQL Database and SQL Data Warehouse

As the link you provid said:

Users in a contained database that have the ALTER ANY USER permission, such as members of the db_owner and db_securityadmin fixed database roles, can grant access to the database without the knowledge or permission or the SQL Server administrator. Granting users access to a contained database increases the potential attack surface area against the whole SQL Server instance.

When the customer is creating any other database users, please be very careful about granting users the ALTER ANY USER permission.