Permissions and security groups in Azure DevOps — quick notes
Azure DevOps permissions — quick notes
| Concept | Detail |
|---|---|
| Assign at scale | Prefer built-in or custom groups; targeted direct-user grants remain supported |
| Built-in groups | Readers · Contributors · Build Administrators · Project Administrators · Project Collection Administrators |
| States | Allow · Deny · Not set |
| Precedence | For most groups/permissions, Deny overrides Allow; documented exceptions exist |
| Not set | No explicit grant; another group or supported object inheritance may determine access, otherwise implicit denial |
| Scopes | Organization/collection · project · object; parent inheritance is namespace-specific |
| Pipeline protected resources | User permissions · pipeline permissions · checks |
| Other permissioned objects | Queries and query folders have object permissions but are not pipeline protected resources |
Trap: do not turn the usual Deny rule or object inheritance into an exceptionless global hierarchy.
Sources: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400 · https://learn.microsoft.com/en-us/azure/devops/organizations/security/about-permissions?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/organizations/security/permission-performance-recommendations?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/pipelines/security/resources?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/organizations/security/set-object-level-permissions?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/boards/queries/set-query-permissions?view=azure-devops · https://learn.microsoft.com/en-us/azure/devops/organizations/security/permissions-access?view=azure-devops