Design and implement permissions and security groups in Azure DevOps

In this lesson, you’ll learn how to configure permissions and manage security groups in Azure DevOps to enforce a least-privilege Role-Based Access Control (RBAC) model. This knowledge is essential for the AZ-400 exam.

We’ll cover:

1. Managing organization-level users
2. Configuring projects and teams
3. Reviewing built-in security groups
4. Creating custom security groups
5. Securing repositories and pipelines
6. Auditing permissions regularly

1. Manage Organization Users

1. Go to Organization Settings (lower-left) → Users.
2. View existing members (e.g., [email protected], Jeremy [email protected], [email protected]).
3. Click Add Users, enter the email or service principal, choose an Access Level (Basic, Stakeholder, Visual Studio Subscriber), and assign projects.

2. Configure Project Settings and Teams

1. Select your organization (e.g., KodeKloud demo) and open the Simple Converter project.
2. Navigate to Project Settings (lower-left) → Overview to see Project Administrators.

Default Team

1. Under Teams, click Simple Converter.
2. Invite members explicitly—even project admins must be added here to inherit team permissions.

3. Review Built-in Security Groups

1. In Project Settings → Security → Permissions, select a built-in group (e.g., Build Administrators).
2. Inspect granular permissions:

• View analytics: Allow
• View project-level information: Allow
• Create tag definitions: Allow
• Create/Delete test runs: Allow
• Manage test configurations/environments: Allow
• View test runs: Allow

Best Practices

• Grant only necessary permissions (least-privilege).
• Use explicit Deny to override undesired inherited Allow.
• For temporary tasks, add users to privileged groups, then remove them immediately.

4. Create Custom Security Groups

1. Navigate to Security → New Group.
2. Name it JavaScript Developers and add members (e.g., Lloyd).
3. By default, it inherits permissions from Project Valid Users.

Grant additional rights:

• Create tag definitions: Allow
• Create/Delete test runs: Allow

Team-Level Customization

Under Teams → Simple Converter → Settings, you can:

• Create sub-teams (e.g., Test Group).
• Assign only required permissions (e.g., View project-level information).

5. Secure Repositories and Pipelines

Use Azure DevOps security settings to fine-tune code and CI/CD access:

1. Go to Repos or Pipelines → Security.
2. Adjust permissions per role.

6. Regular Review and Audit

• Periodically review all security groups and permissions.
• Remove or deny obsolete accounts.
• Track changes via Audit Logs to maintain compliance.

Links and References

• AZ-400 Exam (Microsoft Learn)
• Azure DevOps REST API Security
• Role-Based Access Control (RBAC) in Azure