Last updated: August 29, 2026.
A database user can remain after its server login is missing or has a different SID. This often appears after restoring a database on another instance.
Report and repair the mapping
USE YourDatabase;
GO
SELECT dp.name AS DatabaseUser, dp.sid
FROM sys.database_principals AS dp
LEFT JOIN sys.server_principals AS sp ON dp.sid = sp.sid
WHERE dp.authentication_type_desc = 'INSTANCE'
AND dp.type IN ('S','U','G')
AND sp.sid IS NULL;
GO
ALTER USER [AppUser] WITH LOGIN = [AppLogin];Verify before changing
- Confirm that the login represents the same identity.
- Create the login first when it is truly missing.
- Review role membership and explicit grants.
- Test application access with least privilege.
Confirm identity before remapping
A matching name does not prove that a database user and server login represent the same principal. Review the SID, login type, ownership, and role memberships before using ALTER USER.
Test application access with the intended login and least privilege after remapping. Check every restored database because the same server login may map correctly in one database and not another.
- Create a missing login deliberately.
- Avoid broad role grants as a shortcut.
- Record the mapping in migration checks.
Run administrative statements first in a controlled environment and record the current configuration. Keep a rollback or restore path, use least privilege, and verify the result through the same client path used by the application.
Continue with login SID transfer, restore to another server, and contained users.
Practical implementation check
Before changing production, record the server version, relevant configuration, current object state, and a tested recovery path. Run the diagnostic query with an account that has only the permissions it needs. Apply the smallest change that addresses the evidence, then repeat the original check and monitor application behavior instead of assuming a successful statement completed the task.
Record the final setting or object state in the deployment notes, including why it was chosen. That evidence makes later capacity reviews, migrations, and incident response substantially faster.
Reference: Microsoft ALTER USER documentation.
