You can't change the permission of SA login in SQL Server:
You also can't drop the login SA:
You can disable the login SA:
ALTER LOGIN sa DISABLE
GO
...or enable it:
ALTER LOGIN sa ENABLE
GO
You can rename SA login (renaming will not change the default SID which is 0x01):
ALTER LOGIN sa WITH NAME = [new_name];
After renaming a login, jobs owned by the renamed login may fail with the error similar to this:
'The owner (sa) of job syspolicy_purge_history does not have server access'
Restart the SQL Server Agent service if you got this error.
To check the name of a login when you know the SID, run the following query:
SELECT * FROM sys.syslogins WHERE sid = 0x01
To see how to enable, disable or rename other logins in SQL Server read related blog post:
How to Enable, Disable or Rename a Login in SQL Server