Restricted logins with automatic full permission in databases My scenario:
I have some groups with full - and inappropriate - access to all Sql Server instances. I want to change that.

My Plan:
Give full and automatic access to all databases (it is customer databases and this groups must be allowed to change any property if necessary).

Restrict permissions on Instance Level, because this groups should not be allowed to do any unexpected change on instance properties.

I don't want to create a user in databases, because our external customer could drop the user ( they have db_owner permission )

Someone have any idea?
Tks
You can create a user that has certain non-db_owner fixed database roles assigned, and then you can create a user-defined role which contains additional permissions. (See https://msdn.microsoft.com/en-GB/library/ms189121.aspx) 

So in effect, you can create a user that has all the rights of db_owner except say, managing users and dropping database. But I don't think there's a way to directly deny such privileges, you have to instead add everything but them. 

Your database creation SP can configure new databases in this way, and you’d have to do it for each existing database.