Restrict new user invitations from Project and Team Administrators

Azure DevOps Services

By default, all administrators can invite new users to their Azure DevOps organization. Disabling this policy blocks Team and Project Administrators from inviting new users. Project Collection Administrators (PCAs) can add new users to the organization, regardless of the policy status. If a user is already a member of the organization, Project and Team Administrators can add that user to a project.

Prerequisites

• You must be a member of the Project Collection Administrator group to manage this policy. To get added, see Change project collection-level permissions.

Turn off policy

1. Sign in to your organization (https://dev.azure.com/{yourorganization}).

2. Select Organization settings.

   

3. Under Security, select Policies, and then move the toggle to off.

   

Now, only Project Collection Administrators can invite new users to Azure DevOps.

Note

Known limitation: Even with the policy turned off, Team and Project Administrators can re-invite users who were previously members of the organization.

Related articles

• Default permissions and access
• Permission lookup guide
• Get started with permissions, access, and security groups
• Permissions and groups reference
• Change project-level permissions
• Change project collection-level permissions