The whole point of roles like the `db_datareader` role is that you don't have to explicitly define read permissions for every person in that role for every object. So, you won't find a row in there for every user in the role. This is not a query, but you should essentially do this: 1. Get all the users who have been *explicitly* granted access to that table, and for which a DENY/REVOKE does not exist. 2. Get all the users who are members of any of the roles that implicitly grant read access to the given object (but again also check for explicit DENY/REVOKE).