Copy-DbaLogin Permissions sync only Server Roles and Server securables

[AlejandroPR]

Summarize Functionality

We have a system where logins gets created regularly. We are using copy-dbalogin to sync logins between nodes in Availability groups.
With a large number of databases copy-dbalogin performs slower than we would like.
When using the -ExcludePermissionSync performance is great but server permissions are not carried over.

It would be helpful if the function has an option for Server Permissions only and avoids looping through all databases for database permissions.

Is there a command that is similiar or close to what you are looking for?

No

Technical Details

No response

[andreasjordan]

I think this would need a change of Update-SqlPermission as the mappings are handled there. Maybe a new switch parameter -NoDatabaseMapping to skip some parts.

Maybe I find time to have a deeper look, but let's first ask the other contributors what they think.

[andreasjordan]

@claude please have a look at this issue.

[claude]

Claude finished @andreasjordan's task in 2m 19s —— View job • claude/issue-8312-20260403-1515 • Create PR ➔

---

Analysis of Issue #8312

Summary

Implemented a new -ExcludeDatabaseMapping switch parameter for Copy-DbaLogin that addresses the performance issue: it syncs only server-level roles and securables, skipping the expensive database mapping loop.

Before this change, the options were:

Flag	Server perms	DB perms	Speed
(none)	✅	✅	slow (many DBs)
-ExcludePermissionSync	❌	❌	fast

After this change:

Flag	Server perms	DB perms	Speed
(none)	✅	✅	slow (many DBs)
-ExcludePermissionSync	❌	❌	fast
-ExcludeDatabaseMapping	✅	❌	fast ✨

Changes

private/functions/Update-SqlPermission.ps1

• Added [switch]$ExcludeDatabaseMapping parameter
• Added early return when the switch is set, skipping both database mapping loops (destination sync and source mapping)

public/Copy-DbaLogin.ps1

• Added .PARAMETER ExcludeDatabaseMapping documentation
• Added [switch]$ExcludeDatabaseMapping to the param block
• Converted the Update-SqlPermission call to a splat (it now has 5+ parameters) and passes ExcludeDatabaseMapping through

tests/Copy-DbaLogin.Tests.ps1

• Added "ExcludeDatabaseMapping" to the parameter validation list

Usage

# Sync logins with only server-level permissions (fast, no DB loop)
Copy-DbaLogin -Source sql1 -Destination sql2 -ExcludeDatabaseMapping

Tasks

• Gather context and read issue
• Read Copy-DbaLogin implementation
• Read Update-SqlPermission implementation
• Understand current permission sync flow
• Implement -ExcludeDatabaseMapping switch in Update-SqlPermission
• Implement -ExcludeDatabaseMapping switch in Copy-DbaLogin
• Update tests
• Commit and push changes

|