SQL Server Audit Action Group: DATABASE_PRINCIPAL_CHANGE_GROUP

This group tracks the creation modification or deletion of database principles which include database users, database roles and application roles.

If you enable this group in a server audit specification, it will track changes to principles in all databases within that SQL Server instance. If you enable this group inside a database audit specification, it will only track changes to principles within that particular database.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24121	Issued a create database user command
24122	Issued a change database user command
24123	Issued a delete database user command
24124	Issued a create database role command
24125	Issued a change database role command
24126	Issued a delete database role command
24127	Issued a create application role command
24128	Issued a change application role command
24129	Issued a delete application role command
24130	Issued a change database user login command
24131	Issued an auto-change database user login command

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard