TL;DR
During installation, DB24 performs four operations that each require elevated privileges on the SQL Server instance and that, taken together, in practice require sysadmin. Once the installation is finished, the Datastore server's Agent account only needs datareader and datawriter on the DB24_Data and DB24 databases on each server.
Important to note: sysadmin is required only for the installation itself. After installation, DB24 runs under a separate service account with the least privileges possible (datareader & datawriter).
Why sysadmin is needed when installing DB24
Installing DB24 performs a number of operations on the SQL Server instance that, together, require sysadmin rights. Each step is described below along with why it requires the highest privilege level.
1. Creating new databases (DB24_MAC, DB24_Data, DB24)
The installation creates three new databases on the instance. Creating databases at the instance level requires either the dbcreator server role or sysadmin. Because the installation also configures database ownership, file placement and initial settings, sysadmin is necessary to ensure that all steps can complete without interruption.
2. Configuring a login for the Datastore service account
So that Datastore can collect facts from the included Runtimes, the installation creates a login on the SQL Server instance and grants it the necessary rights (datareader & datawriter) on each Runtime database. Creating and configuring server logins is an instance-level operation that requires sysadmin (or the securityadmin role combined with other rights, which in practice amounts to sysadmin for this scenario).
3. Setting up SQL Agent Jobs
DB24 uses SQL Agent Jobs to schedule data collection and maintenance. Creating, owning and configuring Agent Jobs — particularly jobs that run under the SQL Server Agent service account or with proxy accounts — requires sysadmin. Without this right it is not possible to create jobs that run in the correct security context.
4. Setting up change-tracking triggers on Runtimes
For DB24 to track changes on the monitored Runtimes, system-level triggers are installed in those databases. Creating DDL or server triggers, and enabling change tracking at the database level, requires sysadmin on the instance.
Privilege verification during installation
To guard against half-finished installations, we verify at the beginning of the install process that the account performing the installation actually has the rights required for all of the steps above. This is a deliberate safety measure — we would rather stop the installation immediately with a clear error message than have it fail halfway and leave the instance in an inconsistent state.
Summary
Sysadmin is not required for DB24 to run — it is required specifically for the installation step, because the installer touches several areas (databases, logins, Agent Jobs and triggers) that each demand elevated privileges and which, taken together, in practice can only be performed by a sysadmin. After installation, DB24 runs under a separate service account with the minimum necessary rights.