How to fix Error 4630 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 4630 — “The permission ‘%.*ls’ is not supported in this version of SQL Server”

Why This Error Happens

This error occurs when a T-SQL script, migration file, or restored database object references a permission name that has been deprecated, renamed, or removed in SQL Server 2025. This commonly happens after restoring a database backup from an older SQL Server version, running legacy deployment scripts, or using third-party tools that generate permission statements based on outdated compatibility levels. The engine parses the GRANT/DENY/REVOKE statement but rejects it because the permission token no longer exists in the current security catalog (sys.fn_builtin_permissions).

Step-by-Step Resolution Guide

Step 1: Identify the Offending Permission and Script

  • Open SQL Server Management Studio (SSMS) or Azure Data Studio and locate the exact script or job causing Error 4630.
  • Check the SQL Server Error Log (Management > SQL Server Logs) or Event Viewer under Applications and Services Logs > Microsoft > SQL Server for the exact permission name substituted into %.*ls.
  • Run the following query to confirm whether the permission still exists:
SELECT * FROM sys.fn_builtin_permissions(DEFAULT)
WHERE permission_name = 'YOUR_PERMISSION_NAME';

Step 2: Cross-Reference Deprecated Permissions List

  • Review Microsoft’s official “Breaking Changes in SQL Server 2025” documentation (accessible via https://learn.microsoft.com/sql/database-engine/breaking-changes) for a list of removed permissions (commonly affects legacy permissions tied to SHOWPLAN, SQL/CLR assemblies, or old CONTROL SERVER subpermissions).
  • Note the modern replacement permission name, if one exists (e.g., deprecated ADMINISTER BULK OPERATIONS may now map to ADMINISTER DATABASE BULK OPERATIONS depending on scope).

Step 3: Update and Re-run the Script

  • Edit the script (commonly found in deployment folders such as C:\Scripts\Deploy\ or within a DACPAC/BACPAC deployment contract) to replace the deprecated permission with its modern equivalent.
  • If the issue originates from a restored database compatibility level, update it:
ALTER DATABASE [YourDatabaseName] SET COMPATIBILITY_LEVEL = 170;
  • Re-execute the corrected script in a test environment before deploying to production.

Step 4: Rebuild Permission Grants via Server Role Mapping

  • If the permission was tied to a legacy server role, map it to the new fixed server roles introduced in SQL Server 2025 (e.g., ##MS_ServerStateReader##, ##MS_DatabaseConnector##).
  • Use sp_helprotect or sys.server_permissions to audit current grants before reapplying with updated syntax.

Alternative or Verification Steps

  • Verify the fix by re-running the deployment script or restore operation and confirming no 4630 errors appear in the SQL Server Error Log.
  • As an alternative, if legacy compatibility is required temporarily, isolate the affected database on a side-by-side SQL Server 2019/2022 instance until all permission references are modernized, then migrate once scripts are updated.