Set pipeline permissions

TFS 2018

Pipeline permissions and roles help you securely manage your pipelines. You can set hierarchical permissions at the organization, server, project, and object levels for all pipelines in a project or for an individual pipeline. You can update pipeline permissions with security groups or by adding individual users.

Object-level permissions are more granular than organization-level permissions, so you can increase the security of your pipeline. For example, a user could have access to your Azure Repos repository thanks to their organization-level permissions. However, that same user could be prevented from running a pipeline manually because of that object/pipeline's permissions.

In this article, we break down the permissions to the following levels of permissions:

• Project-level permissions
• Object-level permissions:
  • Release
  • Task group
  • Agent pool
  • Library
  • Service connection
  • Deployment pool
  • Environment

For more information, see Get started with permissions, access, and security groups, Securing Azure Pipelines, and Verify permissions for contributors.

For information about setting permissions with Azure CLI, see the Azure CLI reference.

Prerequisites

• To manage permissions and add users to Azure Pipelines for project-level groups, you must be a Project Administrator. For more information, see Project-level group permissions.
• To manage permissions for collection groups, you must be a Project Collection Administrator. For more information, see collection-level group permissions.
• Keep the following information in mind when you're setting pipeline permissions.
  • In many cases, you might want to set Delete build pipeline to Allow. Otherwise, these team members can't delete their own build pipelines.
  • Without the Delete builds permission, users can't delete their own completed builds. However, they can automatically delete old unneeded builds with retention policies.
  • We recommend that you don't grant permissions directly to a user. A better practice is to add the user to the build administrator group or another group, and manage permissions for that group.

For more information and best practices, see Securing Azure Pipelines.

Default permissions assigned to built-in security groups

Build

Release

Set project-level pipeline permissions

Build and YAML pipeline permissions follow a hierarchical model. You can set defaults for all permissions at the project-level and override permissions for an individual build pipeline.

To set the permissions at project-level for all pipelines in a project, choose Security from the action bar on the main page of Builds hub.

Set individual pipeline permissions

To set or override the permissions for an individual pipeline, choose Security from the context menu of the individual pipeline.

Pipeline permissions reference

You can set the following permissions for all pipelines in a project or for an individual pipeline. Default values are set for project collections and project groups. For example, Project Collection Administrators, Project Administrators, and Build Administrators have all these permissions by default.

All team members are members of the Contributors group. This group permission allows you to define and manage builds and releases. The most common built-in groups include Readers, Contributors, and Project Administrators.

For more information, see the following articles:

• Default permissions and access quick reference
• About permissions and inheritance
• About security roles.

Set release permissions

Permissions for release pipelines follow a hierarchical model. You can set default permissions at the project-level, and you can override these permissions on an individual release pipeline.

To set permissions at project-level for all release definitions in a project, open the shortcut menu from the

To set or override the permissions for a specific release pipeline, open the shortcut menu from the icon next to that pipeline name. Then choose Security to open the Permissions dialog.

To specify security settings for individual stages in a release pipeline, open the Permissions dialog by choosing Security on the shortcut menu that opens from More actions on a stage in the release pipeline editor.

Release permissions reference

The following table defines permissions for releases. The scope column explains whether the permission can be set at the project, release pipeline, or stage level.

Default values for all permissions are set for team project collections and project groups. For example, Project Collection Administrators, Project Administrators, and Release Administrators are given all the previously listed permissions by default. Contributors are given all permissions except Administer release permissions. By default, Readers are denied all permissions except View release pipeline and View releases.

Set task group permissions

Use task groups to combine a sequence of tasks already defined in a pipeline into a single, reusable task.

Task group permissions follow a hierarchical model. You can set default permissions at the project-level, and you can override these permissions on an individual task group pipeline.

Task group permissions reference

Set agent pool permissions

You can use predefined roles to configure security on agent pools in a hierarchical manner for all pools, or for an individual pool. Do the following steps to set agent pool permissions for all pools.

Set library permissions

Use a variable group to store values that you want to make available across multiple build and release pipelines. Define roles to help you configure security on shared library entities. You can also configure the inheritance of roles.

Library permissions reference

Set service connection permissions

Configure permissions for all service connections or for an individual connection.

Add users to the following roles from the project-level admin context, Services page. For more information about how to create and manage these resources, see Service connections for build and release. If you're having trouble with permissions and service connections, see Troubleshoot Azure Resource Manager service connections.

Service connection permissions reference

Set deployment pool permissions

You can set default security roles for all deployment groups and manage security roles for an individual deployment group.

Deployment pool permissions reference

FAQs

See the following frequently asked questions (FAQs) about pipeline permissions.

Q: Why can't I create a new pipeline?

A: You need Edit build pipeline permissions to create a new pipeline. To add permission, open the security settings for all pipelines and verify that Edit build pipeline is set to Allow for your security group.

If you still can't create a pipeline, check to see if your access level is set to Stakeholder. If you have stakeholder access, change your access to Basic.

Related articles

• Set build and release permissions
• Default permissions and access
• Permissions and groups reference
• Troubleshoot Azure Resource Manager service connections