SQL Agent Reader Permissions

The read-only twin of the SQL Agent admin grants. A user with this setup can browse every job, alert, operator and notification in SSMS - but cannot change anything. It creates the user in master and msdb, adds db_datareader to both, grants SELECT/EXECUTE on the xp_sqlagent_* procedures and agent tables instead of ALL, and adds them to SQLAgentReaderRole and SQLAgentUserRole.

USE [master]
GO

--Create user in database [master]:
CREATE USER [<username>] FOR LOGIN [<username>]
GO

--Grant user access to read/write objects in database [master]:
EXEC sp_addrolemember N'db_datareader', N'<username>'
GO

--Grant user access to SQL agent objects in database [master]:
GRANT SELECT ON master.dbo.sysperfinfo TO [<username>]
GO
GRANT EXECUTE ON master.dbo.xp_sqlagent_notify TO [<username>]
GO
GRANT EXECUTE ON master.dbo.xp_sqlagent_enum_jobs TO [<username>]
GO
GRANT EXECUTE ON master.dbo.xp_sqlagent_param TO [<username>]
GO
GRANT EXECUTE ON master.dbo.xp_sqlagent_is_starting TO [<username>]
GO
GRANT EXECUTE ON master.dbo.xp_instance_regenumvalues TO [<username>]
GO

USE [msdb]
GO
--Create user in database [msdb]:
CREATE USER [<username>] FOR LOGIN [<username>]
GO

EXEC sp_addrolemember N'SQLAgentReaderRole', N'<username>'
GO
EXEC sp_addrolemember N'SQLAgentUserRole', N'<username>'
GO

--Grant user access to read/write objects in database [msdb]:
EXEC sp_addrolemember N'db_datareader', N'<username>'
GO

--Grant user access to SQL agent objects in database [msdb]:
GRANT SELECT ON msdb.dbo.sp_help_alert TO [<username>]
GO
GRANT SELECT ON msdb.dbo.sp_help_notification TO [<username>]
GO
GRANT SELECT ON msdb.dbo.sysalerts TO [<username>]
GO
GRANT SELECT ON msdb.dbo.sysoperators TO [<username>]
GO
GRANT SELECT ON msdb.dbo.sysnotifications TO [<username>]
GO