how can I add user who can read all tables in database and have permission to alter only one table
Add the user to the db_datareader role within the database

sp_addrolemember @rolename = 'db_datareader' @membername '&lt;USERNAME&gt;'


Give the user permission to alter that single table

grant alter on [&lt;TABLE&gt;] to [&lt;USER&gt;]


This will give the permissions you want. You could also create a specific database role with the correct permissions, or grant the user permissions on the schema so you should check the msdn article suggested by @randolph-west