SQL Server logins and users -- assign multiple logins to a single user? In SSMS, since I can't assign multiple login objects to a single user object, what is a best practice to achieve an equivalent security model? 

For example, I have 20 logins and want to give them all the same permissions on a single database:


Do I have to create 20 user objects in that database?
Do I have to touch all 20 Login objects?
Since you are using SQL Server local logins, they cannot be grouped.  Each login is independent and each login needs a user in the database.

Where you can get some saving in specifying rights is to create roles, to which you grant, revoke, or deny rights.  (Note that deny rights override grant rights.)  Then use these roles to give rights to the users.

This way a role contains the specifications of permissions, rather than applying those to every user individually.

After this you can add the users to the roles that user needs.  For example:


Allen - ReadOnly role
Sally - ReadOnly role, MaintainAccounts role
Zenubia - UpdateNonSecureData Role
etc.


This preserves your security settings at the role level, so you should not need to repeat those grants.  Just add or remove a user from a role, when needed.