db_backupoperator is a SQL Server fixed database role that grants permissions to back up a database. It supports least privilege instead of giving a backup account sysadmin access across every instance. section 14.1
Mistake: granting sysadmin to a backup tool
A vendor may claim that its backup tool requires sysadmin. Granting that access creates a broad security and operational risk: a compromised account could reach organizational data, while unnoticed changes may cause performance or stability problems. A more appropriate arrangement is often ##MS_DatabaseManager## at the server level plus db_backupoperator in the databases being backed up. section 14.1
Apply the safer authorization rule:
- Grant only the fixed server or database roles required by the application. section 14.1
- Create a custom role when no suitable built-in role provides the required permissions. section 14.1
