This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 59%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPB%3C/text%3E%3C/svg%3E)
Have a SQL Server 2019 Enterprise Edition instance and been seeing some strange items popping up in the Database Audit report again role member changes. They're being performed by the instance's service account and are occurring on the hour, every hour. I ran a trace capture to see what was happening and the relevant SPID related to the ApplicationName "Microsoft SQL Server Extension Agent".
Can anyone tell me what this is, how it's controlled/configured or what it's purpose is?
Thanks.
Hi @Peter Bishop,
As far as i know, there is preview version for SQL Server Agent extension.
It is used to manage and troubleshooting SQL Agent jobs and configuration. This extension is currently in preview.
See SQL Server Agent extension (Preview)
Regards，
Zoe Hui
If the answer is helpful, please click "Accept Answer" and upvote it.
Hi Peter,
The SQL Server extension agent is what facilitates automated management features. For example, it is what allows you to use the Azure portal to enable automated backup, updates, set/view Azure Hybrid Benefit Licensing option.
The role member changes you are seeing are likely due to least privilege mode. The extension will grant minimum amount of permissions necessary for the features that are enabled via custom roles.
Automate management with the Windows SQL Server IaaS Agent extension
Please click Accept Answer and upvote if the above was helpful.
Thanks.
-TP
Thanks TP for the information and the link.
However we're not running on an Azure Windows Virtual Machine, it's just Windows Server 2019. Is there a way to identify the triggering process that is causing this to run hourly - it's not an Agent job.
To confirm: are/were you using Azure Arc? You could have vm extension(s) installed on on premises VMs which would allow you to manage them via Azure.
Please check if SQL Server IaaS Agent is installed in the VM. Key places to check:
Thanks.
Not that I'm aware of but I'll check with our Infrastructure Team. Thanks again.
@Peter Bishop Any update? I think you have an older version of the SQL Server IaaS Agent and perhaps the VM was/is on Azure Arc.
I looked in one my VMs and the audit entries have "Microsoft SQL Server IaaS Agent" for the Application Name, however, I did some searching and found this post with screenshot showing "Microsoft SQL Server Extension Agent" for application name as you describe. Below is link to the post if you are interested:
Based on your description with role membership changes that is what the agent normally does. Having it log that every hour doesn't seem normal so maybe something is broken.
Sorry for the delay; been on leave.
I can't find the "Microsoft SQL Server IaaS Agent" application but there is a "Microsoft Sql Server Extension Service" service running.
I can't find any configuration file(s) associated with this service which determines the instances to be monitored. As mentioned, I have one instance reporting these audit changes whereas another one on the same server doesn't.