You have two Azure virtual machines named Server1 and Server2 that run Windows Server 2022 and are joined to an Active Directory Domain Services (AD DS) domain named contoso.com. Both virtual…

Granting the `Impersonate a client after authentication` user right to the `contoso\sqlproxy` account on Server2 is essential for the SQL Server Agent proxy to execute job steps using the security context of that account.

While network access is generally needed for remote operations, granting `Access this computer from the network` is not the specific permission required for a proxy account to impersonate and run job steps locally on the target server.

The question implies using the proxy account created on Server1. The solution for multi-server jobs often involves leveraging the `AllowDownloadedJobsToMatchProxyName` setting and appropriate Windows user rights on the target, rather than creating a duplicate proxy account object on Server2.

The `AllowDownloadedJobsToMatchProxyName` registry entry must be set on the *target* server (Server2), not the master server (Server1), to allow it to process downloaded jobs using a specified proxy account.

Setting the `AllowDownloadedJobsToMatchProxyName` registry entry to `1` on Server2 permits the target SQL Server Agent to use a proxy account for downloaded jobs, even if the proxy account object is not explicitly defined on the target server, by matching the proxy name to a Windows account with appropriate permissions.