SQL Agent Job Modification Minimum Permission Requirement - sql-server-2016

Question

I need permission to modify other users job in sql server 2016 in dev environment but DBA team is saying they can't give me sysadmin role. So is their any other option present without sysadmin so that I can modify jobs created by other users.

Answer 1

Directly, no. But you can ask your sysadmins to create a wrapper stored procedure, which calls msdb.dbo.sp_update_job, has the same parameters and executes as privileged user. And then to give you, or SQLAgentOperatorRole (if everybody should be able to modify not only his jobs, but all) rights to execute it. In the example below, the stored procedure is executed by owner. It assumes its owner will be sysadmin. If needed, you can change this and for example specify particular login instead.
USE msdb
GO
CREATE PROC [dbo].[sp_update_job_for_non_admins]
#job_id UNIQUEIDENTIFIER = NULL,
#job_name sysname = NULL,
#new_name sysname = NULL,
#enabled TINYINT = NULL,
#description NVARCHAR(512) = NULL,
#start_step_id INT = NULL,
#category_name sysname = NULL,
#owner_login_name sysname = NULL,
#notify_level_eventlog INT = NULL,
#notify_level_email INT = NULL,
#notify_level_netsend INT = NULL,
#notify_level_page INT = NULL,
#notify_email_operator_name sysname = NULL,
#notify_netsend_operator_name sysname = NULL,
#notify_page_operator_name sysname = NULL,
#delete_level INT = NULL,
#automatic_post BIT = 1
WITH EXECUTE AS OWNER
AS
BEGIN
EXEC dbo.sp_update_job
#job_id
,#job_name
,#new_name
,#enabled
,#description
,#start_step_id
,#category_name
,#owner_login_name
,#notify_level_eventlog
,#notify_level_email
,#notify_level_netsend
,#notify_level_page
,#notify_email_operator_name
,#notify_netsend_operator_name
,#notify_page_operator_name
,#delete_level
,#automatic_post
END
GO
GRANT EXECUTE ON [dbo].[sp_update_job_for_non_admins] TO [SQLAgentOperatorRole]
The credits for this solution are for Boris Hristov.