How to Revoke Privileges in MySQL

Use REVOKE to remove privileges previously granted to a MySQL account. A revocation names the account and the privilege scope; it does not remove the account itself. The examples below use 'john'@'localhost' and illustrative objects. No MySQL server version or execution evidence was supplied, so treat the SQL as syntax examples and check the documentation for your installed version before applying them.

Understand MySQL privilege scope

An account is identified by both its user name and host, such as 'john'@'localhost'. A different host part can identify a different account, so confirm the exact account before changing access. REVOKE removes only the named privileges at the stated level. Common levels include global (*.*), database (sales.*), table (sales.orders), and column (a column list on a table). A broader grant may still provide access after a narrower grant is removed.

The corresponding GRANT statement is useful context when reviewing how access was assigned. GRANT OPTION is separate: it lets an account grant privileges onward. SHOW GRANTS helps inspect the account’s current grants after a change.

Revoke specific privileges

Name the privileges, object level, and account. For example, this syntax illustration removes table-level SELECT from the specified account:

REVOKE SELECT ON sales.orders FROM 'john'@'localhost';

To remove more than one privilege at that same level, list them separated by commas:

REVOKE SELECT, INSERT ON sales.orders FROM 'john'@'localhost';

Use the scope that matches the grant you intend to change. For example, ON sales.* refers to the database level, while ON *.* refers to the global level. A column-level grant requires naming the relevant column in the privilege specification; do not substitute a table-level command and assume it has the same scope.

This Python snippet assembles a readable statement for the example account. It only creates a string; it does not connect to MySQL or execute the SQL statement. The supplied runtime evidence records the Python snippet succeeding, but the SQL itself was not run against a MySQL server.

Run this example:

account = "'john'@'localhost'"
table = "sales.orders"
statement = f"REVOKE SELECT ON {table} FROM {account};"
print(statement)

REVOKE SELECT ON sales.orders FROM 'john'@'localhost';

Revoke all privileges and grant option

To remove all privileges and the ability to grant privileges for one account, use the broad revocation form:

REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'john'@'localhost';

This targets the named account; it is not a command for revoking access from every MySQL account. It also does not drop the account. Confirm the intended account carefully before using a broad revocation, and inspect its remaining grants afterward. If you need to remove only the ability to pass privileges to others, treat GRANT OPTION as the specific privilege to revoke rather than assuming that revoking ordinary data privileges also removes it.

MySQL does not use PUBLIC in this syntax as a universal target for every account. To change access for multiple accounts, issue an appropriately scoped operation for each actual account and verify each result; do not infer a global effect from a single-account command.

Revoke roles and role privileges

Role assignment and direct privilege grants are related but distinct. A role can supply privileges to an account, so removing a direct privilege may not remove access the account receives through a role. Likewise, revoking a role assignment is a separate task from revoking a privilege.

Role syntax and behavior can depend on the installed MySQL version and configuration. Because no version was supplied, this guide does not prescribe a role-revocation statement. Consult the documentation for the exact server version, identify whether the access comes from a direct grant or an assigned role, and then choose the matching operation.

Verify changes and troubleshoot

After a revocation, inspect the target account with SHOW GRANTS FOR 'john'@'localhost';. Review the returned grant statements at the relevant scope and account for any role grants shown. The output depends on the account and its grants; there is no universal success transcript to copy. The examples here have not been run against a MySQL server.

If the account still has access, check that the host part matches the account used to connect, look for broader grants such as database or global privileges, and inspect role-derived access. If a command is rejected, verify the privilege level and syntax against your server’s version documentation and ensure the operator has authority to revoke that grant. Rechecking with SHOW GRANTS after correcting the account or scope helps distinguish an unchanged grant from access supplied elsewhere.