mssql_manage_users
Create, drop, and alter SQL Server logins and database users, plus grant or revoke permissions on schemas, tables, and other objects.
Instructions
Manage SQL Server logins, database users and permissions - create, drop, alter users, grant/revoke permissions. Examples: operation="create" with username="app_user", password="...", operation="grant" with username, permissions, target, targetType
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| login | No | Enable/disable the login | |
| schema | No | Schema of object targets (defaults to dbo); filter for get_permissions | |
| target | No | Target object/schema/database name (for grant/revoke operations) | |
| cascade | No | drop: transfer owned schemas to dbo first; revoke: CASCADE | |
| inherit | No | Accepted for compatibility; reported as unsupported | |
| createdb | No | dbcreator server role (unsupported on Azure SQL Database) | |
| ifExists | No | Include IF EXISTS clause (for drop operation) | |
| password | No | Password (required for create; optional for alter) | |
| userType | No | login = server login + database user; contained = database-scoped user; auto = contained on Azure SQL Database, login elsewhere | auto |
| username | No | User name (required for create/drop/alter/grant/revoke, optional filter for get_permissions/list) | |
| operation | Yes | Operation: create (login + user, or contained user), drop, alter, grant, revoke, get_permissions, list | |
| superuser | No | sysadmin server role (db_owner on Azure SQL Database) | |
| createrole | No | securityadmin server role (db_securityadmin on Azure SQL Database) | |
| targetType | No | Type of target (for grant/revoke; filter for get_permissions) | |
| validUntil | No | Accepted for compatibility; reported as unsupported | |
| permissions | No | Permissions to grant/revoke | |
| replication | No | Accepted for compatibility; reported as unsupported | |
| connectionLimit | No | Accepted for compatibility; reported as unsupported | |
| withGrantOption | No | Allow the user to grant these permissions to others (for grant operation) | |
| connectionString | No | SQL Server connection string (optional; requires --allow-tool-connection-string) | |
| includeSystemRoles | No | Include system principals (for list operation) |