Dev's have RO access through their domain account, but are using SQL login which has SA access to connect to SQL. Anyway to identify the domain account who connects to SQL using SQL login?
Further on Jason's good reply, why on earth would devs have an sa access to the server, sounds bonkers to me! 😎