GRANT syntax for domain\user

Question

I'm trying to give access to an active directory user to only one specific table. I want them to be able to insert, update, delete, etc. but only for that table. I know this command:

GRANT Insert, Select on Tablename to user 

But I can't figure out how to get "domain\user" to work syntax-wise. I tried:

GRANT Insert, Select on Tablename to domain\user 

But I get:

Msg 102, Level 15, State 1
Incorrect syntax near '\'.

Answer 1

Assuming you have created a user in this database associated with the AD login, e.g.

CREATE LOGIN [domain\user] FROM WINDOWS; GO USE your_database; GO CREATE USER [domain\user] FROM LOGIN [domain\user]; GO 

Then you merely have to follow the same syntax. Because \ is not a standard character for an identifier, you need to escape the name with [square brackets]:

GRANT SELECT, INSERT, UPDATE, DELETE ON dbo.Tablename TO [domain\user]; 

Answer 2

It is a good practice to create a role and add users to that role. Then grant permissions to that role.

USE database_name GO  --1)create role  CREATE ROLE role_name GO  --2 create user IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = N'domain\user') BEGIN     CREATE USER [domain\user] FOR LOGIN [domain\user] END; GO  -- 3 Add user to the role ALTER ROLE [role_name] ADD MEMBER [domain\user] GO  --4 Grant permissions to the role GRANT SELECT, INSERT, UPDATE, DELETE ON dbo.Tablename TO [role_name];