Skip to content

Commit 7082617

Browse files
Clarify SENSITIVE_BATCH_COMPLETED_GROUP behavior
Updated the description for SENSITIVE_BATCH_COMPLETED_GROUP to clarify its behavior regarding database context and cross-database queries.
1 parent b14eda7 commit 7082617

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

docs/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ The following table describes the database-level audit action groups and provide
150150
| `SCHEMA_OBJECT_CHANGE_GROUP` | This event is raised when a `CREATE`, `ALTER`, or `DROP` operation is performed on a schema. Equivalent to the [Audit Schema Object Management Event Class](../../event-classes/audit-schema-object-management-event-class.md).<br /><br />This event is raised on schema objects. Equivalent to the [Audit Object Derived Permission Event Class](../../event-classes/audit-object-derived-permission-event-class.md). Also equivalent to the [Audit Statement Permission Event Class](../../event-classes/audit-statement-permission-event-class.md). |
151151
| `SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP` | This event is raised when the permissions to change the owner of schema object such as a table, procedure, or function is checked. This occurs when the `ALTER AUTHORIZATION` statement is used to assign an owner to an object. Equivalent to the [Audit Schema Object Take Ownership Event Class](../../event-classes/audit-schema-object-take-ownership-event-class.md). |
152152
| `SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP` | This event is raised whenever a grant, deny, or revoke is issued for a schema object. Equivalent to the [Audit Schema Object GDR Event Class](../../event-classes/audit-schema-object-gdr-event-class.md). |
153-
| `SENSITIVE_BATCH_COMPLETED_GROUP` | This event is raised whenever any batch text, stored procedure, or transaction management operation completes executing on sensitive data classified using [SQL Data Discovery & Classification](../sql-data-discovery-and-classification.md). The event is raised after the batch completes and audits the entire batch or stored procedure text, as sent from the client, including the result. <br /><br /> Available starting with [!INCLUDE [sssql22-md](../../../includes/sssql22-md.md)]|
153+
| `SENSITIVE_BATCH_COMPLETED_GROUP` | This event is raised whenever any batch text, stored procedure, or transaction management operation completes executing on sensitive data classified using [SQL Data Discovery & Classification](../sql-data-discovery-and-classification.md). The event is raised after the batch completes and audits the entire batch or stored procedure text, as sent from the client, including the result. When configured at the database scope, SENSITIVE_BATCH_COMPLETED_GROUP only captures activity executed within the current database context.Cross‑database queries (for example, queries that access sensitive data in the current database from another database or master) are not captured by a database‑level audit specification.To ensure auditing coverage for cross‑database access to sensitive data, SENSITIVE_BATCH_COMPLETED_GROUP must be enabled in a server audit specification. <br /><br /> Available starting with [!INCLUDE [sssql22-md](../../../includes/sssql22-md.md)]|
154154
| `SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP` | Indicates that a principal successfully logged in to a contained database. |
155155
| `USER_CHANGE_PASSWORD_GROUP` | This event is raised whenever the password of a contained database user is changed by using the ALTER USER statement. |
156156
| `USER_DEFINED_AUDIT_GROUP` | This group monitors events raised by using [sp_audit_write](../../system-stored-procedures/sp-audit-write-transact-sql.md). |

0 commit comments

Comments
 (0)