Troubleshooting Guide: Error 5376 – Cannot Modify Permissions for Index on Expression Column

Why This Error Happens

This error occurs because SQL Server 2025 does not permit explicit permission modifications (GRANT, DENY, REVOKE) directly on computed/expression columns that are referenced by an index, as the engine treats indexed expression columns as derived metadata objects rather than standard securables. This is typically triggered when a DBA or application role attempts to run a column-level security statement against a table where the target column is part of an indexed computed expression. Additionally, this can surface after an in-place upgrade from SQL Server 2022 to 2025, where legacy permission scripts attempt to re-apply column-level ACLs that are no longer compatible with the new Index-on-Expression security model.

Step-by-Step Resolution Guide

Step 1: Identify the Conflicting Index and Column

Open SQL Server Management Studio (SSMS) 21 or Azure Data Studio connected to your SQL Server 2025 instance.
Run the following query to locate the specific expression column causing the conflict:

  SELECT i.name AS IndexName, c.name AS ColumnName, c.is_computed 
  FROM sys.indexes i 
  INNER JOIN sys.index_columns ic ON i.object_id = ic.object_id AND i.index_id = ic.index_id
  INNER JOIN sys.columns c ON ic.object_id = c.object_id AND ic.column_id = c.column_id
  WHERE c.is_computed = 1;

Note the IndexName and ColumnName returned in the result set.

Step 2: Drop and Isolate the Index Before Applying Permissions

Since permissions cannot be applied while the index is active on the expression, you must temporarily drop the index.
Use the following T-SQL syntax, replacing placeholders with your specific table and index names:

  DROP INDEX [YourIndexName] ON [dbo].[YourTableName];

Apply your required GRANT/DENY/REVOKE statements to the base table or the underlying physical columns used in the expression (not the computed column itself).

Step 3: Rebuild the Index with Updated Security Context

Once permissions have been successfully applied to the underlying base columns, recreate the index on the expression column.
Ensure the WITH (DROP_EXISTING = ON) clause is used if you are modifying an existing structure to maintain fragmentation efficiency:

  CREATE INDEX [YourIndexName] ON [dbo].[YourTableName] ([YourExpressionColumn]) WITH (DROP_EXISTING = ON);

Restart the SQL Server service via services.msc on Windows Server 2025 to clear any cached permission metadata if the error persists immediately after the rebuild.

Step 4: Check Group Policy and TLS Restrictions

On Windows 11 or Windows Server 2025 hosts, verify that Group Policy restrictions regarding “Network access: Restrict clients allowed to make remote calls to SAM” are not interfering with the SQL Server service account’s ability to modify schema-level security.
Navigate to Local Security Policy > Local Policies > Security Options to review these settings if the error correlates with a specific Windows user account rather than a SQL login.

Alternative or Verification Steps

Verification: Run SELECT * FROM fn_my_permissions('YourTableName', 'OBJECT'); to confirm that the “ALTER” and “CONTROL” permissions are correctly inherited by the expression column following the index rebuild.
Alternative: If the error persists, create a non-computed, persisted shadow column via ALTER TABLE ADD... PERSISTED, apply the specific permission set to that physical column, and then update the application logic to query the new persisted column instead of the original expression.