Login with readonly to all databases
You can grant db_datareader to any user (map to a login) that you want. This will address the &quot;all actual databases&quot;.
For the future database, as all new databases are created based on the [model] database, if you create a user in the [model] DB that has the &quot;db_Datareader&quot; role, then when a new DB will be created, it will contains that user as well.
If your new database come from backup restore, then this won't work and you may want to look at something like a trigger.