---
title: "Why DB24 Requires Sysadmin During Installation"
description: "Sysadmin is required only when installing DB24. Learn why and how DB24 runs least-privilege after install."
lang: en
json-ld: |
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "DB24",
    "url": "https://db24.ai",
    "logo": "https://db24.ai/logo.png",
    "description": "Intelligent SQL Server Automation - Automate database management, enhance security, and optimize performance",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "sales",
      "email": "sales@db24.ai"
    },
    "sameAs": [
      "https://www.linkedin.com/company/db24"
    ]
  }
---

[![DB24 Logo](/lovable-uploads/152150d5-49f3-4c01-b0f4-8365df95171b.png)](/)DB24 Docs 

Installation 

Modifications 

[DB24 Permissions ](/docs/db24-permissions)[Prerequisites ](/docs/prerequisites)[Installation Guide ](/docs/installation-guide)

Technical Documentation 

Release Notes 

[Docs](/docs)installation 

# DB24 Permissions

Copy Link

Last updated: April 28, 2026 • 

installation

security

permissions

sysadmin

sql-server

## TL;DR

During installation, DB24 performs four operations that each require elevated privileges on the SQL Server instance and that, taken together, in practice require **sysadmin**. Once the installation is finished, the Datastore server's Agent account only needs **datareader** and **datawriter** on the `DB24_Data` and `DB24` databases on each server.

Important to note: **sysadmin is required only for the installation itself.** After installation, DB24 runs under a separate service account with the least privileges possible (datareader & datawriter).

* * *

## Why sysadmin is needed when installing DB24

Installing DB24 performs a number of operations on the SQL Server instance that, together, require sysadmin rights. Each step is described below along with why it requires the highest privilege level.

### 1\. Creating new databases (DB24\_MAC, DB24\_Data, DB24)

The installation creates three new databases on the instance. Creating databases at the instance level requires either the `dbcreator` server role or `sysadmin`. Because the installation also configures database ownership, file placement and initial settings, sysadmin is necessary to ensure that all steps can complete without interruption.

### 2\. Configuring a login for the Datastore service account

So that Datastore can collect facts from the included Runtimes, the installation creates a login on the SQL Server instance and grants it the necessary rights (datareader & datawriter) on each Runtime database. Creating and configuring server logins is an instance-level operation that requires sysadmin (or the `securityadmin` role combined with other rights, which in practice amounts to sysadmin for this scenario).

### 3\. Setting up SQL Agent Jobs

DB24 uses SQL Agent Jobs to schedule data collection and maintenance. Creating, owning and configuring Agent Jobs — particularly jobs that run under the SQL Server Agent service account or with proxy accounts — requires sysadmin. Without this right it is not possible to create jobs that run in the correct security context.

### 4\. Setting up change-tracking triggers on Runtimes

For DB24 to track changes on the monitored Runtimes, system-level triggers are installed in those databases. Creating DDL or server triggers, and enabling change tracking at the database level, requires sysadmin on the instance.

* * *

## Privilege verification during installation

To guard against half-finished installations, we verify at the beginning of the install process that the account performing the installation actually has the rights required for all of the steps above. This is a deliberate safety measure — we would rather stop the installation immediately with a clear error message than have it fail halfway and leave the instance in an inconsistent state.

* * *

## Summary

Sysadmin is **not** required for DB24 to run — it is required specifically for the installation step, because the installer touches several areas (databases, logins, Agent Jobs and triggers) that each demand elevated privileges and which, taken together, in practice can only be performed by a sysadmin. After installation, DB24 runs under a separate service account with the minimum necessary rights.

[Previous Data Platform Version Lift ](/docs/data-platform-version-lift)[Next Prerequisites ](/docs/prerequisites)