I've been working on giving a development team the ability to have read-only access to a SQL environment, I'm at the last step. I need them to be able to see users/logins and roles. I noticed that with view defintion granted on any given DB, it allows their login to view the users/roles for each DB, however even granted on master/msdb/model it does not allow the login to view the server wide logins/roles. What would be the best way to accomplish this? I have tried view defintion and I have tried view server state, neither has worked for server logins to be visible to the user.

Note: I don't want them to have any more access beyond that so I don't want them to be assigned a predefined role.

  • How are you attempting to query logins? Are you using sys.server_principals?
    – Mike Fal
    Jan 23, 2013 at 16:05
  • Just the gui for ease of use. When view definition is granted you can view users in a DB from SSMS, I would assume this is doable with logins as well, but don't know the permission.
    – Sheddy
    Jan 23, 2013 at 16:16

1 Answer 1


GRANT VIEW ANY DEFINITION will allow you to grant the ability to view any metadata on the server. This includes security information at the server level. This means that the user will be able to view other metadata as well, such as object definitions, which might be outside the scope of your goal.

  • Awesome, that's exactly what I needed and fits within the confines of the intended permissions.
    – Sheddy
    Jan 23, 2013 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.