Grant permissions to view or create SQL Server reports in TFS
Azure DevOps Server 2020 | Azure DevOps Server 2019 | TFS 2018 - TFS 2013
Azure DevOps Server was previously named Visual Studio Team Foundation Server.
This is the third task in the four-task sequence to add reports to your team project. You can use the procedures in this article to set permissions to view or author reports.
Feature availability: You can only add a report server to an on-premises TFS. If you're using Azure DevOps, adding a report server isn't a supported option, instead, you can use the Analytics Service.
Now that you've uploaded reports, you'll want to enable members of your team to view or manage them. Also, to create or modify reports, you'll need to grant them access to read databases.
Add accounts to predefined roles to view or manage reports
Add report viewers to the Browser role. Add TFS report authors to the Team Foundation Content Manager role.
Permissions to access Report Manager are managed separately from TFS permissions. Even if you have added team members to a TFS group, you will still have to add them to a Report Manager role.
If you haven't been added to the Content Manager role for Reporting Services, get added by someone who has been added to this role.
From the Report Manager home page, open Folder Settings.
The URL is http://ReportServer/Reports/Pages/Folder.aspx, or if using a named instance, http://ReportServer/Reports_InstanceName/Pages/Folder.aspx.
Open New Role Assignment.
To limit access to reports defined for a team project or team project collection, first navigate to the corresponding folder and then open New Role Assignment.
Add the account name and select their role.
Add report authors to database roles
If members need to create or customize reports, add their accounts to the TfsWarehouseDataReader role. Report authors need read access to both the relational data warehouse and Analysis Services cube. Team members who create Excel reports from work item queries or by connecting to the cube need only read access to the cube.
If you aren't an administrator for the TFS database, get added as one.
Connect to the Database Engine for TFS using SQL Server Management Studio.
Open the properties page for the TfsWarehouseDataReader role under the Databases/Tfs_Warehouse/organizations/security/Roles/Database Roles folder.
Add the account.
Next, connect to the Analysis Services database.
Open the properties page for the TfsWarehouseDataReader role under the Databases/Tfs_Analysis/Roles folder.
Add the account.
Accounts that you add to the TfsWarehouseDataReader roles can view data for all team projects that are hosted in all team project collections in the TFS deployment. There is no way to limit access to a team project or collection.