title: mssql: monitoring/trace permissions used
body: <p>for GDPR reasons i like to give "tailor-made" permissions to our Developers and to other logins that have at the moment db_owner-rights.</p>
  
  <p>Our security-team asked me, if it is possible to monitor, which permissions this logins uses in fact.</p>
  
  <p>The idea is to monitor for a month which privileges the logins uses and after have collected this information go to discuss with the developers.</p>
  
  <p>If the developers pretends to have db_owner - permissions (or even higher permissions), than i can argument: 
  "Look, in the last month in reality you used only this, this, and this permission and so i don't think you need really db_owner - rights..."</p>
  
  <p>I have done some research but i don't find a solution that sadisfys this goal:</p>
  
  <ul>
  <li>The default trace don't traces all used permissions.</li>
  <li>Maybe with extended events i can achieve my goal</li>
  <li>SQL Auditing seems to be an other possibility</li>
  <li>Triggers seems a bad way to achieve my goal</li>
  </ul>
  
  <p>So i ask, someone has done this kind of "monitoring" too and can tell me how it has implemented it?</p>
  
  <p>I need it for SQL 2014 and newer versions...</p>
  
  <p>Thanks</p>