Set permissions on queries and query folders

Azure Boards | Azure DevOps Server 2019 | TFS 2018 | TFS 2017 | TFS 2015 | TFS 2013

As with most project objects, you can control who has access by setting permissions. With queries, you can configure users and groups to create, delete, view, and manage permissions of shared queries and shared query folders.

All users can create and edit their own queries and save them under My Queries.

By default, only project administrators can create and edit queries and folders under Shared Queries, or change the permissions for a query or folder.

By creating folders under Shared Queries, you can grant permissions to users for each folder. For example, if you have several teams contributing to a project, then you might want to create a folder under Shared Queries for each team to manage their own set of shared queries.

Prerequisites

  • You must be a member of the Project Collection Administrators or Project Administrators groups to create or edit a shared query or manage permissions.
  • Or to create a query or folder under a shared query folder, you must have the Contribute permission set explicitly to Allow to
  • Or to change permissions of a query or query folder, you must have the Manage Permissions permission set explicitly to Allow.

Tip

Consider creating a query folder for each team and give the team administrators or the team group query permissions to manage their folder.

Default query permissions

A  checkmark in the following table indicates that the corresponding access level or security group has access to a feature by default.

Task Stakeholders Readers Contributors Project admins
View and run managed queries checkmark checkmark checkmark checkmark
Create and save managed My queries checkmark checkmark checkmark
Create and save managed Shared queries
(Stakeholders can't save Shared queries even if granted permissions)
checkmark
View query charts checkmark checkmark checkmark
Create query charts checkmark checkmark
Powerful semantic work-tracking search checkmark checkmark checkmark checkmark
Task Stakeholders Readers Contributors Team admins
View and run managed queries checkmark checkmark checkmark checkmark
Create and save managed queries
(Stakeholders can't save shared queries)
checkmark checkmark checkmark
View query charts checkmark checkmark checkmark
Create query charts checkmark checkmark

Set permissions on a new query folder

You set permissions from the web portal. To open Queries, see View, run, or email a query.

If you're not a member of the project administrators group, get added, or have your Contribute permission set to Allow for the Shared query folder.

  1. Choose All. Expand Shared Queries.

  2. To add a folder, choose the  actions icon for an existing folder or the top container folder, and choose New folder.

    Open Actions menu, choose New folder

  3. Enter the name for the folder. If you want to change the location of the folder, select it from the Folder drop down menu.

    Here we name the folder Service Delivery with the intention that it will be used by the Service Delivery team.

    New folder dialog

  4. To set permissions for the folder you just added, choose the  actions icon and select Security.

  5. Change the permissions so that the team member or group can contribute and manage permissions for the folder. Choose the Add... menu to add a user identity or group.

    Here we add the Service Delivery team and grant them permissions to create and manage permissions to all queries and folders under the Service Delivery folder.

    Permissions dialog for a query folder

    Contribute allows team members to create and edit queries and folders under the folder where the permissions were granted. And, Manage Permissions allows team members to manage the permission settings on queries and subfolders.

  6. (Optional) Turn inheritance off. Default is On. By turning inheritance off for a folder, you disallow inheritance of permissions that exist up the chain of query folders. To learn more, see Permissions, Inheritance.

  1. Add a query folder under Shared queries or a sub-folder. Choose the  context menu icon for the folder and choose New query folder.

    New query folder link on queries context menu

  2. To set permissions for the folder, choose the  context menu icon for the folder you just added and choose Security.

    Permissions dialog for a query folder

  3. Change the permissions so that the team member or group can contribute and manage permissions for the folder.

    Here we add the Web team and grant them permissions to create and manage permissions to all queries and folders under the Triage folder.

    Permissions dialog for a query

    Choose the Add... menu to add a user identity or group.

    Contribute allows team members to create and edit queries and folders under the folder where the permissions were granted. And, Manage Permissions allows team members to manage the permission settings on queries and subfolders.

  4. (Optional) Turn inheritance off. Default is On. By turning inheritance off for a folder, you disallow inheritance of permissions that exist up the chain of query folders. To learn more, see Permissions, Inheritance.

Set permissions on a shared query

To keep anyone else from modifying a shared query that you create, you may want to set permissions on a specific query. You can do this by opening the permissions dialog for the specific query.

  1. Choose the  actions icon and select Security.

    Open query permissions

  2. Change the permissions so that the team member or group can't edit, delete, or change permissions for the query.

    Here we deny permissions for project admins.

    Permissions dialog for a query

  1. Choose the  context menu icon and select Security.

    Open query permissions

  2. Change the permissions so that the team member or group can't edit, delete, or change permissions for the query.

    Here we deny permissions for project admins.

    Permissions dialog for a query

With queries, you can not only list work items, you can create status and trend charts and add them to dashboards. You can learn more about permissions and working with queries from these resources:

Q & A

Q: Can I change the owner of a query or folder?

A: No. This feature was removed for TFS 2015. You can only enable permissions for users and groups from the permissions window for the query or folder.

Q: Can I add folders to team favorites?

A: No. You can only add folders under My Queries and under Shared Queries.

Q: Are the queries and folders I create from the web portal the same as in Team Explorer?

A: Yes. You might have to refresh your browser or client to see changes you make in another client.

Q: Can I move a query or a folder?

A: Yes. In the web portal, choose Rename from the context menu. In Team Explorer for Visual Studio, simply drag the folder to the new location.

In Team Explorer for Eclipse, choose Move from the context menu and select the folder to which you want to move the item.