Security and permission management tools for Azure DevOps

Azure DevOps Services | Azure DevOps Server 2020 | Azure DevOps Server 2019 | TFS 2018 - TFS 2013

While you set most permissions through the web portal, you can use other tools to manage security groups and permissions. For permissions that aren't available to manage through the web portal,you have the option to manage them using a command line tool.

To learn more about permissions not available through a user interface, see the Security namespace and permission reference, Internal namespaces and permissions.

Important

Select a version from Azure DevOps Content Version selector.

To view the content available for your platform, make sure that you select the correct version of this article from the version selector which is located above the table of contents. Feature support differs depending on whether you are working from Azure DevOps Services or an on-premises version of Azure DevOps Server.
To learn which on-premises version you are using, see What platform/version am I using?

Additional options include the following tools:

You manage server-level permissions and security groups through the Team Foundation Administration Console, as well as a few select collection-level permissions.

You can use the tools listed in the following table to set permissions. Links in the table connect you to the article for setting permissions through the web portal.

Permission level Web portal security pages az devops CLI Tf CLI
Add users to an organization ✔️ ✔️
Organization-level, auditing, enterprise policies, process, workspaces ✔️ ✔️
Project-level, test management, create tags ✔️ ✔️
Git repository ✔️ ✔️ ✔️
Team Foundation Version Control ✔️ ✔️ ✔️
Builds, Task groups ✔️ ✔️
Build resources ✔️ ✔️
Pipeline security roles ✔️ ✔️
Releases ✔️ ✔️
Area path (CSS) ✔️ ✔️
Iteration path ✔️ ✔️
Delivery plans ✔️ ✔️
Work item query ✔️ ✔️
Work item tags ✔️ ✔️
Analytics views ✔️ ✔️
Dashboards ✔️ ✔️
Notifications or alerts ✔️
Permission level Web portal security pages az devops CLI TFSSecurity CLI Tf CLI
Add users to a server instance ✔️ ✔️ ✔️
Collection-level, enterprise policies, process, workspaces ✔️ ✔️ ✔️
Project-level, test management, create tags ✔️ ✔️ ✔️
Git repository ✔️ ✔️ ✔️ ✔️
Team Foundation Version Control ✔️ ✔️ ✔️ ✔️
Builds ✔️ ✔️ ✔️
Build resources ✔️ ✔️ ✔️
Pipeline security roles ✔️ ✔️ ✔️
Releases ✔️ ✔️ ✔️
Area path (CSS) ✔️ ✔️ ✔️
Iteration path ✔️ ✔️ ✔️
Delivery plans ✔️ ✔️ ✔️
Work item query ✔️ ✔️ ✔️
Work item tags ✔️ ✔️ ✔️
Analytics views ✔️ ✔️ ✔️
Dashboards ✔️ ✔️ ✔️
Notifications or alerts ✔️ ✔️
Permission level Web portal security pages TFSSecurity CLI Tf CLI
Add users to a server instance ✔️ ✔️
Collection-level, process, workspaces ✔️ ✔️
Project-level, test management, create tags ✔️ ✔️
Git repository ✔️ ✔️ ✔️
Team Foundation Version Control ✔️ ✔️ ✔️
Builds ✔️ ✔️
Build resources ✔️ ✔️
Pipeline security roles ✔️ ✔️
Releases ✔️ ✔️
Area path ✔️ ✔️
Iteration path ✔️ ✔️
Delivery plans ✔️ ✔️
Work item query ✔️ ✔️
Work item tags ✔️ ✔️
Analytics views ✔️ ✔️
Dashboards ✔️ ✔️
Notifications or alerts ✔️ ✔️
Permission level Web portal security pages TFSSecurity CLI Tf CLI
Add users to a server instance ✔️ ✔️
Collection-level, workspaces ✔️ ✔️
Project-level, test management, create tags ✔️ ✔️
Git repository ✔️ ✔️ ✔️
Team Foundation Version Control ✔️ ✔️ ✔️
Builds ✔️ ✔️
Build resources ✔️ ✔️
Pipeline security roles ✔️ ✔️
Releases ✔️ ✔️
Area path (CSS) ✔️ ✔️
Iteration path ✔️ ✔️
Delivery plans ✔️ ✔️
Work item query ✔️ ✔️
Work item tags ✔️ ✔️
Dashboards ✔️ ✔️
Notifications or alerts ✔️ ✔️
Permission level Web portal security pages TFSSecurity CLI Tf CLI
Add users to a server instance ✔️ ✔️
Collection-level ✔️ ✔️
Project-level, test management, create tags ✔️ ✔️
Builds ✔️ ✔️
Build resources ✔️ ✔️
Git repository ✔️ ✔️ ✔️
Team Foundation Version Control ✔️ ✔️ ✔️
Area path ✔️ ✔️
Iteration path ✔️ ✔️
Work item query ✔️ ✔️
Work item tags ✔️ ✔️
Notifications or alerts ✔️
Releases ✔️ ✔️

In addition, Lab Management permissions can be managed through the TFSLabConfig command-line tool.

Setting permissions for SQL Server reports

For information about how to set permissions in Reporting Services, see Grant permissions to view or create SQL Server reports in TFS.

Setting permissions for SharePoint integration

For information about how to set permissions for SharePoint Products integrated with TFS, see Set SharePoint site permissions.

For more information, see Determine permission levels and groups in SharePoint 2013.