While running

select * from sys.server_principals

for public role, in the column is_fixed_role is shown 0

enter image description here enter image description here

But the documentation states that it is a fixed server role. enter image description here

Documentation Link

Although it is stated that public is a little bit different from other roles because we can assign permissions to it. Anyway it is mentioned as a fixed role.

Can anyone explain this dilemma?

  • 2
    Just for clarity, sys.database_principals shows database level things like users, so when checking server level things like logins, you should check sys.server_principals. That won't help here though, because public is also marked as non-fixed there. I'm not sure that it matters - you can't really do anything with the public role whether it's truly fixed or not (e.g. I'm not sure if the docs are wrong or the view is, but I would just post a question on the documentation). Commented Aug 31, 2018 at 14:11

2 Answers 2


One reason that I can think of why public is NOT a fixed role - is_fixed_role is that the permissions can be changed.

From BOL:

The permissions that are granted to the fixed server roles (except public) cannot be changed.

Only assign public permissions on any object when you want the object to be available to all users.

Note: public is implemented differently than other roles, and permissions can be granted, denied, or revoked from the public fixed server roles.

the other fixed server roles permissions cannot be changed.


Public is just an odd duck.

But to apply some retroactive continuity to the documentation you might say that all these built in roles are "fixed" or unchangeable in ways that normal roles are not. The roles marked as is_fixed_role have fixed permissions and changeable membership. Public has fixed membership (everyone) and changeable permissions.

The column in sys.server_principals and sys.database_principals should be documented to clarify this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.