What’s the issue?
ALTER ANY SERVER AUDIT is a server-level permission that allows a principal to create, modify, and drop SQL Server Audit objects and their specifications. It is held implicitly by members of sysadmin and can also be granted directly to any login with GRANT ALTER ANY SERVER AUDIT TO [LoginName];.
The permission exists so that audit administration can be delegated, typically to a security team that owns the audit configuration but does not otherwise administer the database engine.
This check identifies logins that are not members of sysadmin holding this permission.
Why is this a problem?
The permission allows the holder to disable, alter, or drop the audit entirely. Any activity that occurs while the audit is disabled leaves no record, and if AUDIT_CHANGE_GROUP is not being captured, the modification itself may leave no record either.
That makes this permission a natural first step in a broader attack. An account that can turn off the audit, perform other activity, and turn it back on has effectively erased the detection capability without needing any other privilege, and without appearing in the role memberships that reviews usually examine.
The principals who administer the instance and the principals who control the audit of that instance should ideally not overlap, and a grant that quietly extends audit control to a non-sysadmin login can undermine that separation as easily as it can support it.
What should you do about this?
Identify the affected logins by querying sys.server_permissions for ALTER ANY SERVER AUDIT in a granted state, and review each holder against a required responsibility for audit administration.
Revoke the permission where it is not required using REVOKE ALTER ANY SERVER AUDIT FROM [LoginName];. Where audit administration is genuinely delegated, confirm the holder belongs to the security function rather than the database or application teams whose activity the audit is meant to record.
Confirm AUDIT_CHANGE_GROUP is included in the audit specification so any modification to the audit is itself recorded, and consider forwarding audit data to an external destination so a local change cannot remove the historical record.