What’s the issue?
SQL Server endpoints are the network-facing entry points used by features such as database mirroring, Always On Availability Groups, Service Broker, and SOAP (in older versions). Each endpoint has an owner, recorded in sys.endpoints and visible by joining to sys.server_principals on the principal_id column.The owner is typically set to whichever login created the endpoint, which is often the administrator who performed the initial deployment of the AG, mirroring session, or other feature that depends on the endpoint. The owner controls the endpoint and is the principal under which certain endpoint operations are evaluated.
This finding identifies endpoints whose owners are individual user logins rather than a system or service principal such as sa or a dedicated owner account. The condition is most often the result of endpoints being created ad hoc during initial setup without consideration of long-term ownership.
Why is this a problem?
When an endpoint is owned by an individual user login, the endpoint becomes tied to that person’s account lifecycle. If the user leaves the organization, changes roles, or has their login disabled or dropped, certain endpoint operations and ownership-dependent behaviors can produce errors or unexpected results, particularly during configuration changes or troubleshooting.User-owned endpoints also complicate audit and review. The presence of endpoints owned by former employees or by personal accounts produces audit findings and indicates that endpoint ownership is not being managed deliberately. Since endpoints are part of the infrastructure that connects replicas and instances, ownership clarity is particularly important for understanding the security model of the connected systems.
Ownership of an endpoint is rarely visible in normal monitoring, so the condition often persists undetected. Endpoints continue to accept connections and pass traffic normally under their original owner long after the owning user has moved on, and the issue surfaces only during audits, security reviews, or when the owning account is finally removed.
What should you do about this?
Reassign endpoint ownership to a stable, low-privilege login such as sa or a dedicated service principal using ALTER AUTHORIZATION ON ENDPOINT::[EndpointName] TO [NewOwner];. The change takes effect immediately and does not interrupt existing connections through the endpoint.Establish a standard for endpoint ownership and apply it consistently across the environment, ideally aligning with the same standard used for SQL Agent jobs, Availability Groups, and databases. New endpoints should be created or transitioned to use the standard owner from the start, either by including the ownership step in deployment procedures or by a follow-up step that runs immediately after creation.