Troubleshooting Guide: SQL Server Error 373 – Permission or External Policy Action Denied

Why This Error Happens

Error 373 occurs when SQL Server 2025’s enhanced security layer blocks an operation because the executing principal lacks the specific permission required, or because an external policy provider (such as Azure Policy, Microsoft Defender for SQL, or a custom Extended Policy Engine rule introduced in SQL Server 2025) has explicitly denied the action on the target object. This is distinct from a standard permission error because SQL Server 2025 now checks both native database-level permissions AND external governance policies before allowing an action to complete. In most cases, the root cause is either an incomplete permission grant (GRANT/DENY conflict), a misconfigured Row-Level Security or Dynamic Data Masking policy, or an external compliance policy actively blocking the action regardless of the user’s SQL permissions.

Step-by-Step Resolution Guide

Step 1: Identify the Exact Object and Action Being Denied

• Capture the full error message text, including the %ls values for permission name, action, and object name — these are substituted with real values in the SQL Server error log.
• Check SQL Server Error Log via SSMS (Management > SQL Server Logs) or query it directly:

  EXEC sp_readerrorlog 0, 1, 'Error: 373';

• Note whether the object is a table, stored procedure, external table, or a policy-protected resource (e.g., masked column, ledger table).

Step 2: Verify Native SQL Server Permissions

• Run the following to check effective permissions for the affected login/user:

  SELECT * FROM fn_my_permissions('dbo.TargetObjectName', 'OBJECT');

• Look for explicit DENY statements that may override inherited GRANT permissions:

  SELECT * FROM sys.database_permissions WHERE major_id = OBJECT_ID('dbo.TargetObjectName');

• If a DENY is found, remove it (if appropriate) using:

  REVOKE DENY_PERMISSION_NAME ON dbo.TargetObjectName FROM [UserOrRole];

Step 3: Check External Policy Engine Configuration

• Open SQL Server Configuration Manager or the new Policy Governance Dashboard in SSMS 2025 (Security > External Policies).
• Review any active policies tied to the object’s schema or classification tags:

  SELECT * FROM sys.external_policy_assignments 
  WHERE target_object_id = OBJECT_ID('dbo.TargetObjectName');

• If using Microsoft Defender for SQL or Azure Policy integration, confirm the policy assignment in the Azure Portal under Defender for Cloud > Environment Settings to ensure it isn’t set to “Deny” mode unintentionally.

Step 4: Restart the Policy Synchronization Service

• On Windows Server 2025, open Services.msc and locate SQL Server Policy Sync Agent (MSSQLSERVER).
• Restart the service to force re-synchronization of cached policy rules:

  Restart-Service -Name "SQLPolicySyncAgent"

• This clears stale policy caches that sometimes cause valid permissions to be incorrectly denied.

Step 5: Apply Correct Grants and Re-Test

• Once the conflicting DENY or policy block is resolved, grant the required permission explicitly:

  GRANT SELECT, EXECUTE ON dbo.TargetObjectName TO [UserOrRole];

• Re-run the original operation that triggered Error 373 to confirm resolution.

Alternative or Verification Steps

• Verify the fix by executing the original query/action under the same user context using EXECUTE AS USER = 'AffectedUser' and confirming no Error 373 is thrown.
• If the issue persists, temporarily disable the external policy (in a test environment only) via ALTER EXTERNAL POLICY [PolicyName] DISABLE; to confirm whether the SQL engine or the external policy layer is the actual blocker, then re-enable it once permissions are corrected.