Change access levels

VSTS | TFS 2018 | TFS 2017 | TFS 2015 | TFS 2013

Important

This topic applies to managing access levels for team projects defined on an on-premises Team Foundation Server (TFS). To manage access levels for VSTS, see Manage users and access in VSTS. For VSTS feature availability, see the VSTS Feature Matrix.

To connect and use the functions and features that TFS provides, users must be added to a group with the appropriate permissions. To use select web portal features, they must also belong to the access level that enables access to that feature. For a description and usage information for each access level, see Access levels.

For a simplified overview of the permissions assigned to the most common groups—Readers, Contributors, and Project Administrators—as well as the Stakeholder access group, see Permissions and access.

Important

Even if you set a user or group's access level, you must add them to a team project collection or team project for them to connect to TFS and access features available through a supported client or the web portal.

Make sure to set each user's access level based on what you've purchased for that user. Basic access includes all Stakeholder features. Advanced and Visual Enterprise access levels include all Basic features. In the images provided below, the circled features indicate the features made available from the previous access level.

Open the administrative context, Access levels

You manage access levels for all collections defined on the application tier for TFS. The default access level you set applies to all team projects defined for all collections. Users or groups that you add to teams, team projects, or collections are granted the access level that you set as the default. To change the access level for a specific group or user, you add them specifically to one of the other, non-default access levels.

Note

The images you see from your web portal may differ from the images you see in this topic. These differences result from updates made to your on-premises TFS. However, the basic functionality available to you remains the same unless explicitly mentioned.

From a user context, open the admin context by clicking the gear icon gear Settings icon. The tabs and pages available differ depending on which admin context you access.

TFS 2018, TFS 2017

  1. From the web portal home page for a team project (for example, http://MyServer:8080/tfs/DefaultCollection/MyProject/), open the Server Settings administration context.

    TFS 2017, Web portal, open the Server settings admin context

  2. From the Access levels page, select the access level you want to manage. For example, here we click Add to add a group to Stakeholder access.

    TFS 2017, Web portal, Server settings admin context, Access levels, Stakeholder access level, Add user or group

    If you don't see the Access levels tab, you aren't a TFS administrator and don't have permission. Here's how to get permissions.

TFS 2015, TFS 2013

  1. From the web portal home page for a team project (for example, http://MyServer:8080/tfs/DefaultCollection/MyProject/), open the administration context.

    Open the administration page

  2. From the Access levels page, select the access level you want to manage. For example, here we add a group to Stakeholder access.

    Stakeholder access level, Add Windows user or group

    If you don't see the Access levels tab, you aren't a TFS administrator and don't have permission. Here's how to get permissions.

Change the default access level

Change the default access level to match the access you have licenses for. If you change the default access level to Stakeholder, all users not explicitly added to the Basic or Advanced level will be limited to the features provided through Stakeholder access.

Important

Service accounts are added to the default access level. If you set Stakeholder as the default access level, you must add the TFS service accounts to the Basic or Advanced group.

You set an access level from its page. Click Set as default access level as shown.

Admin context, Control panel, Access levels, Stakeholder tab, set as default access level

Set the access level for a user or group

If you're managing access for a large group of users, a best practice is to first create either a Windows group or TFS group and add individuals to those groups.

Guide to features and access levels

You can learn more about each of the features you have access to from the following topics. Basic includes all features supported by Stakeholder, and Advanced includes access to all features supported by Basic.

Stakeholder access 1 Basic access 5 Advanced access (TFS 2017, TFS 2015, TFS 2013)
- View My Work items
- Standard features: Dashboards & Queries 2
- Agile boards: Backlogs, Kanban & Task 3
- View releases and manage approvals 4
- Basic & Advanced backlog and sprint planning tools
- Request and manage feedback 6
- Chart viewing & Chart authoring
- Code: Git and TFVC
- Build
- Administer account 7
- Advanced home page 8
- Web-based test execution
- Create and manage releases 4
- Author release definitions 4
- Advanced portfolio management
- Team rooms
- Analyze test results and manage machine groups
- Web-based test case management 9

Advanced access will be deprecated in future versions of TFS.

VS Enterprise (TFS 2017.2, TFS 2018)

- Microsoft published TFS Extensions 10

Notes:

  1. With Stakeholder access, users can create and modify all work items, and can create and save queries on all work items under their My Queries folder. (This is a change from Limited access in which users could create and modify only those work items that they created and query and view work items they created.) Also, stakeholders can create and modify work items using Team Foundation clients such as Visual Studio Community, Microsoft Excel, Microsoft Project, and Microsoft Feedback Client.
  2. Standard features include access to the Home and Work hubs.
  3. Includes all backlogs and boards, including product, portfolio, and sprint backlogs and Kanban and sprint task boards. Can add work items to backlogs, which appear at the bottom of the list. Can't reorder items on the page or use some other features. See Stakeholder access for details.
  4. Release Management is in preview and available when you upgrade your application server to TFS 2015 Update 2 or later version.
  5. Basic access allows you to access the Code, Build, and Test hubs in addition to the Home and Work hubs.
  6. Request and manage feedback is now available within the Basic access level when you upgrade your application server to TFS 2015 Update 1 or later version.
  7. You can open the Admin context and view and modify settings provided you are a team, project, or project collection administrator. See Administer account features.
  8. Advanced home page allows you to configure and view the Welcome page in addition to team dashboards.
  9. You can purchase Test Manager extensions and assign to user accounts to gain full access to web-based Test case management tools.
  10. With VS Enterprise access, users have access to any fee-based, Marketplace extension published by Microsoft Marketplace extension published by Microsoft that is included for active Visual Studio Enterprise subscribers. Examples include Package Management (which is also free for 5 users who are not Visual Studio Enterprise subscribers) and Test Manager.

Within the admin context, there are several hubs which support administrating features at the team, project, or project collection level. You can learn more from these resources: