Skip to content

Commit 1897914

Browse files
VanMSFTJillGrant615
VanMSFT
and
JillGrant615
authored
Add bulkadmin permission support docs for SQL Server on Linux (CU3) (#36832)
* Add bulkadmin permission support docs for SQL Server on Linux (CU3) - New article: sql-server-linux-bulk-operations.md - Configuring bulkadmin/ADMINISTER BULK OPERATIONS on Linux - File system setup, mssql-conf allowed paths, SQL permissions - Path restrictions, upgrade/downgrade behavior - Updated BULK INSERT permissions with versioned CU3 guidance - Added CU3 section to What's New for SQL Server 2025 on Linux - Added TOC entry under Security section AB#560340 * Fix formatting of note in bulk insert documentation --------- Co-authored-by: Jill Grant <72043882+JillGrant615@users.noreply.github.com>
1 parent 0a500d9 commit 1897914

4 files changed

Lines changed: 220 additions & 4 deletions

File tree

‎docs/linux/sql-server-linux-bulk-operations.md‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
---
2+
title: Configure Bulk Import Operations for SQL Server on Linux
3+
description: Learn how to configure and use the bulkadmin server role or the ADMINISTER BULK OPERATIONS permission for bulk data import in SQL Server on Linux.
4+
author: VanMSFT
5+
ms.author: vanto
6+
ms.reviewer: matripathy, randolphwest
7+
ms.date: 03/11/2026
8+
ms.service: sql
9+
ms.subservice: linux
10+
ms.topic: how-to
11+
ms.custom:
12+
- linux-related-content
13+
ai-usage: ai-assisted
14+
# customer intent: As a database administrator, I want to configure bulk import operations on SQL Server on Linux so that non-sysadmin users can perform BULK INSERT and OPENROWSET(BULK...) operations securely.
15+
monikerRange: "=sql-server-ver17 || =sql-server-linux-ver17"
16+
---
17+
18+
# Configure bulk import operations for SQL Server on Linux (preview)
19+
20+
[!INCLUDE [sqlserver2025-linux](../includes/applies-to-version/sqlserver2025-linux.md)]
21+
22+
> [!IMPORTANT]
23+
> This feature is currently in preview.
24+
25+
Starting with [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] Cumulative Update (CU) 3, you can use the **bulkadmin** server role or the `ADMINISTER BULK OPERATIONS` permission to perform bulk data import operations on [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] running on Linux. Previously, only members of the **sysadmin** server role could run [BULK INSERT](../t-sql/statements/bulk-insert-transact-sql.md) or [OPENROWSET(BULK...)](../relational-databases/import-export/import-bulk-data-by-using-bulk-insert-or-openrowset-bulk-sql-server.md) on Linux.
26+
27+
[!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] on Linux enforces additional file system and path validation checks for bulk operations, beyond what's required on Windows. An administrator must:
28+
29+
- Grant appropriate [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] permissions to the user
30+
- Grant Linux file system permissions on the data files
31+
- Explicitly approve directory paths using `mssql-conf`
32+
33+
## Prerequisites
34+
35+
- [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] CU 3 or later version on Linux
36+
- Administrative access to the Linux host
37+
- Administrative access to the [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] instance
38+
39+
## Configure the Linux file system
40+
41+
Before you can run bulk import operations, the `mssql` service account must have read access to the data files on the Linux file system.
42+
43+
1. Create a directory for your bulk data files:
44+
45+
```bash
46+
mkdir -p /tmp/bulkload/sales/
47+
```
48+
49+
1. Create a sample data file:
50+
51+
```bash
52+
cat > /tmp/bulkload/sales/loadsalesdata.csv << EOF
53+
Id,CustomerName,OrderDate,Amount
54+
1,John Doe,2026-02-01,500.75
55+
2,Jane Smith,2026-02-05,1500.20
56+
3,Mark Lee,2026-02-10,320.50
57+
4,Alice Johnson,2026-02-15,785.00
58+
5,Bob Brown,2026-02-20,930.40
59+
EOF
60+
```
61+
62+
1. Grant read permission to the [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] process account (`mssql`) on the data file:
63+
64+
```bash
65+
setfacl -m u:mssql:r /tmp/bulkload/sales/loadsalesdata.csv
66+
```
67+
68+
## Configure allowed paths with mssql-conf
69+
70+
An administrator must approve the directories from which bulk operations can read, using the `bulkadmin.allowedpathslist` setting in `mssql-conf`. This change takes effect immediately and doesn't require a [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] service restart.
71+
72+
```bash
73+
sudo /opt/mssql/bin/mssql-conf set bulkadmin.allowedpathslist "/tmp/bulkload/sales"
74+
```
75+
76+
To specify multiple directories, separate each path with a colon (`:`):
77+
78+
```bash
79+
sudo /opt/mssql/bin/mssql-conf set bulkadmin.allowedpathslist "/tmp/bulkload/sales:/tmp/bulkload/marketing"
80+
```
81+
82+
Alternatively, you can specify a parent directory to allow all subdirectories under it.
83+
84+
### Path restrictions
85+
86+
The following restrictions apply to paths configured for bulk operations:
87+
88+
- The path must be an absolute path. Relative paths containing `.` or `..` aren't allowed.
89+
- The root path (`/`) isn't allowed.
90+
- The path must not exceed 4,096 characters.
91+
- The path must not contain invalid characters (null, newline, carriage return, or tab).
92+
- Symbolic links aren't allowed.
93+
- The path must refer to a directory.
94+
95+
### Forbidden paths
96+
97+
The system blocks some critical paths by design. You can't use these locations as source data file paths for bulk operations, even if you add them to the allowed paths list:
98+
99+
- `/var/opt/mssql` (or the [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] installation directory)
100+
- `/var/opt/azcmagent/certs`
101+
- `/var/opt/azcmagent/tokens`
102+
103+
Bulk operations that read source data from these paths fail for security reasons. This restriction doesn't apply to the `ERRORFILE` output path, which uses the [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] data directory by default.
104+
105+
## Set up SQL Server permissions
106+
107+
After you configure the Linux file system and allowed paths, set up the [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] permissions for the user who performs the bulk import.
108+
109+
1. Connect to the [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] instance and create a sample database and table:
110+
111+
```sql
112+
CREATE DATABASE demodbforbulkinsert;
113+
GO
114+
115+
USE demodbforbulkinsert;
116+
GO
117+
118+
CREATE TABLE dbo.Sales (
119+
Id INT NOT NULL PRIMARY KEY,
120+
CustomerName NVARCHAR(200) NOT NULL,
121+
OrderDate DATE NOT NULL,
122+
Amount DECIMAL(18, 2) NOT NULL
123+
);
124+
GO
125+
```
126+
127+
1. Create a login for the bulk import user:
128+
129+
```sql
130+
USE master;
131+
GO
132+
133+
CREATE LOGIN BulkLoadUser WITH PASSWORD = '<strong_password>';
134+
GO
135+
```
136+
137+
1. Grant the `ADMINISTER BULK OPERATIONS` permission or add the login to the **bulkadmin** server role. Use one of the following options:
138+
139+
```sql
140+
-- Option 1: Add to the bulkadmin server role
141+
ALTER SERVER ROLE bulkadmin ADD MEMBER BulkLoadUser;
142+
GO
143+
```
144+
145+
```sql
146+
-- Option 2: Grant the permission directly
147+
GRANT ADMINISTER BULK OPERATIONS TO BulkLoadUser;
148+
GO
149+
```
150+
151+
1. Create a database user and grant the necessary table permissions:
152+
153+
```sql
154+
USE demodbforbulkinsert;
155+
GO
156+
157+
CREATE USER BulkLoadUser FOR LOGIN BulkLoadUser;
158+
GO
159+
160+
GRANT INSERT, SELECT ON dbo.Sales TO BulkLoadUser;
161+
GO
162+
```
163+
164+
## Run a bulk import
165+
166+
Connect to the database as the `BulkLoadUser` login and run the bulk import:
167+
168+
```sql
169+
USE demodbforbulkinsert;
170+
GO
171+
172+
BULK INSERT dbo.Sales
173+
FROM '/tmp/bulkload/sales/loadsalesdata.csv'
174+
WITH (
175+
FIRSTROW = 2,
176+
FIELDTERMINATOR = ',',
177+
ERRORFILE = '/var/opt/mssql/data/bulk_errors'
178+
);
179+
GO
180+
181+
-- Verify the imported data
182+
SELECT * FROM dbo.Sales;
183+
GO
184+
```
185+
186+
The same permissions, Linux file system configuration, and path approval steps apply to `INSERT ... SELECT * FROM OPENROWSET(BULK...)` statements. For more information, see [Import bulk data by using BULK INSERT or OPENROWSET(BULK...)](../relational-databases/import-export/import-bulk-data-by-using-bulk-insert-or-openrowset-bulk-sql-server.md).
187+
188+
## Upgrade and downgrade behavior
189+
190+
Starting with [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] CU 3, [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] on Linux supports bulk operations using the **bulkadmin** role or `ADMINISTER BULK OPERATIONS` permission.
191+
192+
If you uninstall CU 3 or downgrade to an earlier cumulative update:
193+
194+
- Previously granted permissions remain assigned but aren't functional.
195+
- Bulk operations require **sysadmin** permissions, as in versions prior to CU 3.
196+
197+
## Related content
198+
199+
- [BULK INSERT (Transact-SQL)](../t-sql/statements/bulk-insert-transact-sql.md)
200+
- [Import bulk data by using BULK INSERT or OPENROWSET(BULK...)](../relational-databases/import-export/import-bulk-data-by-using-bulk-insert-or-openrowset-bulk-sql-server.md)
201+
- [Security considerations for SQL Server on Linux](sql-server-linux-security-overview.md)
202+
- [SQL Server on Linux - Security and permissions guide](sql-server-linux-security-permissions-guide.md)
203+
- [Configure SQL Server on Linux with the mssql-conf tool](sql-server-linux-configure-mssql-conf.md)

‎docs/linux/sql-server-linux-whats-new-2025.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: "What's New for SQL Server 2025 on Linux"
33
description: In this article, learn about the major features and services available for SQL Server 2025 running on Linux.
44
author: rwestMSFT
55
ms.author: randolphwest
6-
ms.date: 01/27/2026
6+
ms.date: 03/11/2026
77
ms.service: sql
88
ms.subservice: linux
99
ms.topic: whats-new
@@ -23,9 +23,18 @@ This article describes the major features and services available for [!INCLUDE [
2323

2424
This section describes updates for each release of [!INCLUDE [sssql25-md](../includes/sssql25-md.md)].
2525

26+
- [Cumulative Update 3](#cumulative-update-3)
2627
- [Cumulative Update 1](#cumulative-update-1)
2728
- [GA release](#general-availability)
2829

30+
### Cumulative Update 3
31+
32+
The following updates apply to [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] Cumulative Update (CU) 3.
33+
34+
- **Bulk import operations without sysadmin**. You can use the **bulkadmin** server role or the `ADMINISTER BULK OPERATIONS` permission to perform `BULK INSERT` and `OPENROWSET(BULK...)` operations on [!INCLUDE [ssnoversion-md](../includes/ssnoversion-md.md)] on Linux, without requiring **sysadmin** permissions. An administrator must configure Linux file system permissions and approve directory paths using `mssql-conf`.
35+
36+
For more information, see [Configure bulk import operations for SQL Server on Linux (preview)](sql-server-linux-bulk-operations.md).
37+
2938
### Cumulative Update 1
3039

3140
The following updates apply to [!INCLUDE [sssql25-md](../includes/sssql25-md.md)] Cumulative Update (CU) 1.

‎docs/t-sql/statements/bulk-insert-transact-sql.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Transact-SQL reference for the BULK INSERT statement.
44
author: markingmyname
55
ms.author: maghan
66
ms.reviewer: jovanpop, randolphwest, wiassaf
7-
ms.date: 12/09/2025
7+
ms.date: 03/11/2026
88
ms.service: sql
99
ms.subservice: t-sql
1010
ms.topic: reference
@@ -214,7 +214,7 @@ WITH (DATA_SOURCE = 'pandemicdatalake', FIRSTROW = 2, LASTROW = 100, FIELDTERMIN
214214
```
215215

216216
> [!NOTE]
217-
> For simplicity, the following examples use relative paths and predefined external data sources..
217+
> For simplicity, the following examples use relative paths and predefined external data sources.
218218
219219
#### CODEPAGE
220220

@@ -625,7 +625,9 @@ Alternatively, create a [DATABASE SCOPED CREDENTIAL](create-database-scoped-cred
625625

626626
The following permissions apply to the location where the data is being bulk-imported (the target).
627627

628-
Requires `INSERT` and `ADMINISTER BULK OPERATIONS` permissions. In Azure SQL Database, `INSERT` and `ADMINISTER DATABASE BULK OPERATIONS` permissions are required. `ADMINISTER BULK OPERATIONS` permissions or the **bulkadmin** role isn't supported for SQL Server on Linux. Only the **sysadmin** can perform bulk inserts for SQL Server on Linux.
628+
Requires `INSERT` and `ADMINISTER BULK OPERATIONS` permissions. In Azure SQL Database, `INSERT` and `ADMINISTER DATABASE BULK OPERATIONS` permissions are required.
629+
630+
Starting with [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] Cumulative Update (CU) 3, [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] on Linux supports the `ADMINISTER BULK OPERATIONS` permission and the **bulkadmin** role. In earlier versions, only the **sysadmin** role can perform bulk inserts for [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] on Linux. For more information, see [Configure bulk import operations for SQL Server on Linux](../../linux/sql-server-linux-bulk-operations.md).
629631

630632
Additionally, `ALTER TABLE` permission is required if one or more of the following conditions is true:
631633

‎docs/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9252,6 +9252,8 @@ items:
92529252
href: linux/sql-server-linux-custom-password-policy.md
92539253
- name: Enable Microsoft Entra manually for containers
92549254
href: linux/authentication/container-kubernetes-microsoft-entra-deployment.md
9255+
- name: Configure bulk import operations
9256+
href: linux/sql-server-linux-bulk-operations.md
92559257
- name: High availability and disaster recovery
92569258
items:
92579259
- name: Overview

0 commit comments

Comments
 (0)