Greetings,
To the best of our knowledge, when installed as recommended, SedonaOffice and the related databases should fall under Scenario 1:
SQL Server is run on bare metal (no virtual machines)
AND no other untrusted application logic (application tier) is run on the same machine
AND no untrusted SQL Server extensibility interfaces are being used
Unless you deployed SQL on a virtual machine where SedonaOffice should fall under Scenario 4:
SQL Server is run on a virtual machine in a private hosting environment.
AND no other untrusted application logic (application tier) is run on the same machine
AND no untrusted SQL Server extensibility interfaces are being used
SedonaOffice requires none of the following untrusted SQL Server extensibility mechanisms:
SQL CLR assemblies
R and Python packages running through the external scripts mechanism or run from the standalone R/Machine Learning studio on the same physical machine as SQL Server
SQL Agent extensibility points running on the same physical machine as SQL Server (ActiveX scripts)
Non-Microsoft OLE DB providers used in Linked Servers
Non-Microsoft extended stored procedures
COM objects executed within the server (accessed via sp_OACreate)
Programs executed via xp_cmdshell
With the information we currently have, we suggest following the MS recommendation for Scenario 1: Apply all OS and SQL Server updates after normal pre-production validation testing. Enabling Kernel Virtual Address Shadowing (KVAS) should not be required (unless non-SedonaOffice extensibility mechanisms are deployed by other applications).
For Scenario 4: Refer to the hypervisor security documentation for security best practices. See KB 4072698 for Windows Server and Hyper-V. Microsoft recommends installing all OS updates on the guest VM. KVAS should not be required (unless non-SedonaOffice extensibility mechanisms are deployed by other applications).
We have no information on any other scenario at this time.
These recommendations are subject to change as we obtain more data and feedback throughout the community. The impact of enabling KVAS with SedonaOffice is unknown and untested. Recommendations are based on guidance provided by Microsoft https://support.microsoft.com/en-ca/help/4073225/guidance-for-sql-server
