title: Do I need SQL Server db_ddladmin rights for a Entity Framework Code-First Approach and is it a security issue?
body: <p>we have an external project that has been developed using C# &amp; Entity Framework 6 Code First together with SQL Server 2014. 
  It has a web site and a wcf service.</p>
  
  <p>Now, for deployment the project-contractor stated that the IIS APPOOL user under which the web site runs will need membership to db_datareader, db_datawriter and db_ddladmin for it to work and indeed without giving those rights it did not work. </p>
  
  <p>I have certain problems with that because without being a SQL-Guru I feel that a deployment should not need db_ddladmin rights while the contractor says thats perfectly normal with EF Code First and does not see a problem. A search on the net also seems to reveal that those rights can be problematic (<a href="http://akawn.com/blog/2012/02/why-you-should-be-cautious-with-the-dbo_owner-role/" rel="noreferrer">http://akawn.com/blog/2012/02/why-you-should-be-cautious-with-the-dbo_owner-role/</a>) which would also indicate to me that it would be a bit insane that EF framework Code First really would need those rights...</p>
  
  <p>So do I need db_ddladmin for EF Code First?
  And is it problematic that a deployed web project needs database access rights of db_ddladmin?</p>
  
  <p>Thanks in advance!</p>