SQL Server Error 15151

Error number

15151

Severity

16 (user-correctable error)

State

1

Product

Microsoft SQL Server Database Engine

Versions

All supported SQL Server versions (2016 to 2025), Azure SQL Database, Azure SQL Managed Instance

Category

Logins & Permissions

Last reviewed

24 October 2026

What it means

Error 15151 means a security statement named a user, login, role or schema that SQL Server cannot see: either it does not exist in this scope, or you lack the permission that would let you see and change it.

The message is built from three parts: the action (drop, alter, add, find), the kind of principal (user, login, role, schema, principal) and the name in quotes. Read it as "I could not do ACTION on KIND NAME". For example, ALTER ROLE ... ADD MEMBER with a missing member says Cannot add the principal, and a GRANT to a missing user says Cannot find the user.

SQL Server deliberately gives the same answer for "does not exist" and "you may not see it", so that a user without permission cannot probe which principals exist. In our tests a user without ALTER ANY USER trying to drop an existing user got exactly the same message as a drop of a name that does not exist. Severity 16 is a user-correctable error; nothing changed.

Common causes

• The name is wrong: a typo, a missing domain prefix on a Windows user (CONTOSO\appsvc), or brackets missing around a name with special characters.
• You are in the wrong database: users, roles and schemas are per database, so the statement ran in master or another database instead of the one that holds the principal.
• Logins and users were confused: DROP USER was used for a server login, or DROP LOGIN for a database user.
• A deployment script drops or alters a principal that an earlier run (or another script) already removed.
• The caller lacks the permission to change the principal (for example ALTER ANY USER, ALTER ANY ROLE or ALTER ANY LOGIN), so the principal is reported as not found.

Diagnose it

Read-only These queries only read metadata and dynamic management views. They do not change data, permissions or configuration, so they are safe to run first.

SELECT DB_NAME() AS current_database,
       SUSER_SNAME() AS login_name,
       USER_NAME() AS user_name;

SELECT name, type_desc, 'principal' AS kind
FROM sys.database_principals
WHERE name LIKE N'%app%'
UNION ALL
SELECT name, 'SCHEMA', 'schema'
FROM sys.schemas
WHERE name LIKE N'%app%';

SELECT name, type_desc, is_disabled
FROM sys.server_principals
WHERE name LIKE N'%app%';

SELECT permission_name
FROM fn_my_permissions(NULL, 'DATABASE')
WHERE permission_name IN (N'ALTER ANY USER', N'ALTER ANY ROLE', N'ALTER ANY SCHEMA', N'CONTROL');

How to fix it

Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.

USE Sales;
DROP USER [CONTOSO\appsvc];

DROP USER IF EXISTS app_user;
DROP ROLE IF EXISTS app_role;

IF EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'app_user')
    ALTER ROLE db_datareader ADD MEMBER app_user;

CREATE USER app_user FOR LOGIN app_user;
ALTER ROLE db_datareader ADD MEMBER app_user;

GRANT ALTER ANY USER TO [CONTOSO\dba_team];

Examples

Dropping a user that does not exist

DROP USER app_user;

Msg 15151, Level 16, State 1, Line 1
Cannot drop the user 'app_user', because it does not exist or you do not have permission.

Adding a missing user to a role

ALTER ROLE db_datareader ADD MEMBER app_user;

Msg 15151, Level 16, State 1, Line 1
Cannot add the principal 'app_user', because it does not exist or you do not have permission.

The user exists, but the caller has no permission

CREATE USER report_owner WITHOUT LOGIN;
CREATE USER intern WITHOUT LOGIN;
GO
EXECUTE AS USER = 'intern';
DROP USER report_owner;
REVERT;

Msg 15151, Level 16, State 1, Line 2
Cannot drop the user 'report_owner', because it does not exist or you do not have permission.

How to prevent it

Write security changes as scripts that state the database (USE) and use IF EXISTS or catalog checks, and keep them in source control next to the schema. Store principal names exactly as SQL Server shows them, including the domain prefix for Windows users and groups.

Give the people who manage users the specific permissions they need (ALTER ANY USER, db_securityadmin) so that a 15151 really means "not found". The SQL Server security lesson explains logins, users and roles.

Common questions

Learn more on CodeWithSQL

• SQL Server security: logins, users and permissions

Official documentation

• DROP USER (Transact-SQL)
• ALTER ROLE (Transact-SQL)
• Database engine events and errors 15000 to 15999 (Microsoft Learn)

Last technically reviewed 24 October 2026; examples and diagnostics run on SQL Server 2025 (17.0.1145.4). Message text checked against the engine's sys.messages catalogue.