SQL Server can limit which database names a login can see. This is useful on an instance used by several applications, but hiding a database name is separate from controlling access to its data.
Check the login and existing permissions
Use an administrator account in SQL Server Management Studio. Identify the server login to restrict, and record its existing server permissions so that you can restore them if needed. A database user and a server login are different security principals.
The following read-only query lists SQL and Windows logins and groups:
SELECT name, type_desc
FROM sys.server_principals
WHERE type IN ('S', 'U', 'G');Restrict database-name visibility
Replace APP_LOGIN with the existing login’s name, then run:
USE master;
DENY VIEW ANY DATABASE TO [APP_LOGIN];Apply the change to the intended login, rather than public, which would affect other users. Database owners, system databases, the connected database and logins with other sufficient permissions can remain visible.
Verify access separately
Sign in through a new connection as the restricted login and check the database list. Test the application’s required operations as well. Use database users and appropriate database or object permissions to control data access; this visibility setting is not an access-control substitute.
If the login previously had no explicit VIEW ANY DATABASE permission entry, remove this new denial with:
USE master;
REVOKE VIEW ANY DATABASE FROM [APP_LOGIN];If it already had an explicit grant or denial, restore the recorded original permissions instead.