TFS 2012 - Database Project - User with NO LOGIN map to Windows - best practices
The idea of CREATE USER ... WITHOUT LOGIN isn't so you can map it later with ALTER USER ... WITH LOGIN (SQL Server simply refuses, as youhave found).  

Instead, the idea is for application developers to change the security context before issuing SQL statements, by first doing EXECUTE AS USER = '&lt;user&gt;' WITHOUT REVERT to shed permissions.

This kind of gets you halfway to where you want to be.  You ultimately still need to map some SQL Server logins to some SQL Database Users, but you reduce your need to know in advance what they will be, because you declare access-control permissions against the 'WITHOUT LOGIN' user.

See:


User without login purpose
SQL SERVER – Importance of User Without Login – T-SQL Demo Script