I've spent most of today bashing my head against this, and didn't come up with anything. I tried:
- Messing with msdb roles on the CMS
- Messing with msdb roles on the target servers
- Messing with server roles on the CMS and target servers
- Petitioning the gods of old
- Trying something convoluted involving credentials and proxies
In the end, nothing worked. I believe this is possible on SQL Server 2014, which has a "CONNECT ALL DATABASES" server-level permission, but 2012 has no equivalent that isn't also a much larger security risk than I'm willing to accept.
I decided to bite the bullet and add the account as a user on every database. Here's what I did:
exec sp_MSforeachdb 'if ''?'' in (''master'',''msdb'',''tempdb'') return; use [?]; CREATE USER [domain\account] FOR LOGIN [domain\account];'
Executing this script against the CMS added the user to every database on every instance except for master, msdb, and tempdb. I left model in so that when we create databases in the future, they'll already have the user added.
If anyone has a better way that doesn't involve mapping to every database, feel free to share, but at this point I'm not convinced it can be done (short of making the account sysadmin, which I doubt would make it into production).