Search code examples
azure-devops-server-2019

Acces different Azure DevOPS Server project in another role

In our organization we are using different projects in Azure DevOPS Server. When a user is added to a team it gets the Contributor permissions (I know this can be changed). For some project this user can be the owner or a developer so it needs these permissions to do the management of the backlog or use the git repo's. In another project this same user just wish to see the backlog (not mess around with it or change the repo's). But it needs to be able to add a new item as a user of that product managed by that project. So this user cannot be simply made reader only.

Is it possible to restrict the user capabilities in the second project (normally this can be done via the Access levels) to not mess with the backlog?

Solution

  • Update

    To move backlogs/boards from one section to another section on the Backlog Board, one needs to have the Edit work items in this node permission for the Area and Iteration path. You can deny the permission to disable the ability for that specific user.

    You define both areas and iterations for a project from the Project Settings>Work>Project configuration.

    1. Choose (1) Project Settings, expand Work if needed, and choose (2) Project configuration and then (3) Areas.

    enter image description here

    1. Choose the ... context menu for the node you want to manage and select Security.

    enter image description here 3. Select the group or team member, and then change the permission settings.

    enter image description here

    Per my above screenshot, user L can't move work items which is under corresponding area. (and he can't edit work items under Agile area either.)

    When he try to move items in the board (for example new → activity), it will auto back to original location.

    enter image description here

    No, this could not be done via Access level.

    To use some feature such as Code in Azure DevOps, you need to be qualified with two things: Permission , Access Level.

    Access levels enable administrators to provide their user base access to the features they need and only pay for those features. It's corresponding to account in an organization. It's not able to manage Access Level per project.

    In other words, with your scenario you need to use permission to restrict that specific user in the second project.

    1. First add him to second project like Contributor group
    2. Explicitly restrict permission such as Code, Build, Release
    3. Modify the permission of Board area to meet your requirements.