Is there a way to prevent that a user sees all databases in an instance? I tried to deny this from user ‘mark’ by
DENY VIEW ANY DATABASE TO mark
but this prevented him to see (in the SSMS Object Explorer) also the database he is attached to (as a db_reader).
In this case you
DENY VIEW ANY DATABASE TO publicbecause "mark" is a member of public (as are all logins). ReferenceYou don’t remove rights for logins indivially because then all rights are lost even where expected.
Generally, if a login has permissions on an object (database, table, whatever) they can see that object in Object Explorer in SSMS
Edit: it’s not foolproof and the database owner needs changed. Sorry, forgot about that.
Even if the DB is visible, no rights are conferred or implied.