Concerns/risks granting permissions to Execute msdb.dbo.sp_send_dbmail

Question

Hello a Developer is requesting permissions to system Stored Procedure to Execute msdb.dbo.sp_send_dbmail

Are there any concerns/risks that from my DBA perspective before granting Developer's request?

Thanks in advance.

Answer 1

Hi @techresearch7777777 ，

Security issues are common, but there is no known significant security risk with msdb.dbo.sp_send_dbmail, instead it is a relatively simple and secure way to send emails.

Execute permissions for sp_send_dbmail default to all members of the DatabaseMailUser database role in the msdb database, any SQL System Admin can obviously execute the proc, if there is a risk, then it is not just about the proc anymore

The key issue is your dangerous expectations, everything you do on the database may be at risk, such as accessing external resources, connecting to external calculators.

It is recommended that database mail needs to be configured to send database mail alerts and monitored

https://www.sqlservercentral.com/forums/topic/sending-mail-from-database-is-it-a-bad-practice

-------------

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

What for risks do you expect? It sends emails as any other email client.
If you think it's a risk then you have to remove all permissions on Outlook/Exchange Server for the developer as well.

Answer 3

Thanks for all of the replies.