Control access to functional areas

You can configure the initial security settings for the following functional areas for a team project: team queries, Team Foundation version control, Team Foundation Build, and Visual Studio Lab Management. The process templates for Microsoft Solutions Framework (MSF) assign several permissions to default security groups. You can modify these assignments by customizing the plug-in file for the appropriate functional area. 

For information about how to configure security groups for Visual Studio Team Foundation Server, see Configure initial groups, teams, members, and permissions.

For more information about how to administer users and groups and control access to Visual Studio Application Lifecycle Management (ALM), see Manage users or groups in TFS.

Assign permissions to functional areas

You can use the functional permission element to allow or deny permissions for functional areas to a security group in Team Foundation Server, a Windows group, or a Windows identity. You use this element in the plug-in files for work item tracking, Team Foundation version control, Team Foundation Build, and Lab Management. You must encapsulate the permission element within its corresponding container: the permissions element. You use the following syntax structure for the functional permission element:

<permission allow="PermissionName" identity="GroupName"/>
<permission deny="PermissionName" identity="GroupName"/>
<permission allow="PermissionName" deny="PermissionName" identity="GroupName"/>

The following table describes the attributes for the functional permission element:

The following example shows how to grant permissions to allow the Contributors group to view builds and build definitions and to queue builds and edit build quality.

<taskXml>
   <permission allow="Read, PendChange, Checkin, Label, Lock" identity="[$$PROJECTNAME$$]\Contributors"/>
</taskXml>

Assign permissions for work item queries

In the workitems plug-in file, you can assign permissions that control access to team query folders. Query folder permissions are specific to queries and query folders. You can grant access to users and groups in Windows or to default groups that are defined for Team Foundation Server.

You assign these permissions by using the functional permission element, as the following example shows:

<Permission allow="Read, Contribute, Delete, ManagePermissions, FullControl" identity="="[$$PROJECTNAME$$]\$$PROJECTADMINGROUP$$" /> 

The following table describes the permissions that control access to query folders and queries. It also indicates the default assignments that are made in the MSF process templates. By default, the creators or owners of queries and query folders have full control of managing the queries that they created or own.

Permission	Description	Readers, Contributors, Builders	Creator Owners, Project Administrator Group, Project Collection Administrators
Read	Read. Can view and run a query or view a query folder and its contents
Contribute	Contribute. Can view and edit a query or query folder and its contents
Delete	Delete. Can view, edit, and delete a query or query folder and its contents
ManagePermissions	Manage Permissions. Can manage permissions for a query or query folder and its contents
FullControl	Full Control. Can view, edit, delete, and manage permissions for a query or query folder and its contents

Assign permissions for Version Control

You can assign permissions that control access to source code files and folders by changing the plug-in file for version control. Version control permissions are specific to source code files and folders. You can grant access to users and groups in Windows or default groups that are defined for Team Foundation Server.

You assign these permissions by using the functional permission element, as the following example shows:

<permission allow="Read, PendChange, Checkin, Label, Lock, Merge" identity="[$$PROJECTNAME$$]\@@Contributors@@" />

The following table describes the permissions that control access to source code files and folders. It also indicates the default assignments that are made in the MSF process templates.

Permission	Description	Readers	Contributors	Builders	Project Administrator Group
Read	Read. Can display the contents of a file or folder. If a user has Read permissions for a folder but not the files that it contains, the user can display the names and properties of those files, but the user cannot open them.
PendChange	Check out. Can check out and make a pending change to an item. Examples of pending changes include adding, editing, renaming, deleting, undeleting, branching, and merging a file.
Merge	Merge. Can merge changes into the path for which they have permissions.
Checkin	Check in. Can check in items and revise any committed changeset comments. Pending changes are committed when the user checks in the item.
Label	Label. Can label items.
Lock	Lock. Can lock an item so that other users cannot update it.
ReviseOther	Revise another user's changes. Can change the contents of someone else’s changeset comments and check-in notes.
UnlockOther	Unlock another user's changes. Can remove someone else’s lock.
UndoOther	Undo another user's changes. Can undo someone else’s pending changes.
LabelOther	Administer labels. Can modify someone else’s label.
AdminProjectRights	Manage permissions. Can configure security settings for version control.
CheckinOther	Check in another user's changes. Can perform a check-in as another user. This permission is required for conversion utilities.
ManageBranch	Manage branch. Users who have this permission for a given path can convert any folder under that path into a branch. Users who have this permission for a branch can also edit its properties, re-parent it, and convert it to a folder. Users who have this permission can branch this branch only if they also have the Merge permission for the target path. Users cannot create branches from a branch for which they do not have the Manage Branch permission.

Assigning permissions for Build

You can assign permissions that control access to build activities by changing the Build plug-in file. You can grant access to users and groups in Windows and groups in Team Foundation Server. For information about the format to use when you specify groups, see "Default Groups Defined in Team Foundation Server" in Configure initial groups, teams, members, and permissions.

You assign these permissions by using the functional permission element, as the following example shows:

<Permission allow="ViewBuildDefinition, QueueBuilds, ViewBuilds, EditBuildQuality" identity="[$$PROJECTNAME$$]\@@Contributors@@" />

The following table describes the permissions that you can assign that control access to the build functions of a team project. The table also indicates the default assignments that are made in the MSF process templates.

Permission	Description	Readers	Contributors	Build Administrators	Project Administrators	Project Collection Administrators
ViewBuildDefinition	View build definition. Can view the build definitions that have been created for the team project.
ViewBuilds	View builds. Can view the queued and completed builds for this team project.
EditBuildQuality	Edit build quality. Can add information about the quality of the build through the interface for Team Foundation Build.
QueueBuilds	Queue builds. Can add a build to the queue through the interface for Team Foundation Build or at a command prompt.
DeleteBuildDefinition	Delete build definition. Can delete build definitions.
DeleteBuilds	Delete builds. Can delete a completed build.
DestroyBuilds	Destroy builds. Can permanently delete a completed build.
EditBuildDefinition	Edit build definition. Can create and modify build definitions.
ManageBuildQualities	Manage build qualities. Can add or remove build qualities, such as Ready for Deployment, Rejected, or Under Investigation. For more information, see Add or remove build quality values.
ManageBuildQueue	Manage build queue. Can cancel, re-prioritize, or postpone queued builds.
RetainIndefinitely	Retain indefinitely. Can mark a build so that it will not be automatically deleted by any applicable retention policy.
StopBuilds	Stop builds. Can stop a build that is in progress.
OverrideBuildCheckInValidation	Override check-in validation by build. Can commit a changeset that affects a gated build definition without triggering the system to shelve and build the changes first. For more information, see Check in to a folder that is controlled by a gated check-in build process.
UpdateBuildInformation	Update build information. Can add information about the quality of a build. This permission should be assigned only to service accounts.

Assign permissions for Lab Management

You can control access to activities in Lab Management by changing the Lab plug-in file. Permissions for Lab Management are specific to virtual machines, environments, and other resources. You can grant access to users and groups in Windows and groups in Team Foundation Server. You assign these permissions by using the functional permission element, as the following example shows:

<permission allow="Read, Create, Write, Edit, Start, Stop, ManageSnapshots, Pause" identity="[$$PROJECTNAME$$]\@@Contributors@@" />

The following table describes the permissions that you can assign to control access to Visual Studio Lab Management. The table also indicates the default assignments that are made in the MSF process templates.

Permission	Description	Readers	Contributors	Project Collection Build Service Accounts group	Team Project Administrators group	Project Collection Administrators group
Read	View lab resources. Can view information for the various resources for Lab Management, which include collection host groups, project host groups, and environments.
Create	Import virtual machine. Can import a virtual machine from a Virtual Machine Manager (VMM) library share. This permission differs from Write because users can create an object in Lab Management but not write anything to the VMM host group or library share.
Write	Write environment and virtual Machines. Can create environments. Users who have this permission for a project library share can store environments and virtual machines.
Edit	Edit Environment and Virtual Machines. Can edit environments and virtual machines. The permission is checked for the object that is being edited.
Start	Start. Can start an environment.
Stop	Stop. Can stop an environment.
Pause	Pause. Can pause an environment.
ManageSnapshots	Manage snapshots. Can perform all snapshot management tasks, which include taking a snapshot, reverting to a snapshot, renaming a snapshot, deleting a snapshot, and reading a snapshot.
Delete	Delete environments and virtual machines. Can delete environments and virtual machines. The permission is checked for the object that is being deleted.
ManageLocation	Manage lab locations. Can edit the locations of resources for Lab Management, which include collection host groups, collection library projects, project host groups, and project library shares. This permission for collection-level locations (collection host groups and collection library shares) also allows a user to create project-level locations (project host groups and project library shares).
DeleteLocation	Delete lab locations. Can delete the locations of resources for Lab Management, which include collection host groups, collection library shares, project host groups, and project library shares.
ManageChildPermissions	Manage Child Permissions. Can change the permissions of all the child objects of Lab Management. For example, if a user has this permission for a team project host group, that user can change permissions for all the environments under that group.
ManagePermissions	Manage Permissions. Can modify the permissions for an object of Lab Management. This permission is checked for the object whose permissions are being modified.
EnvironmentOps	Environment Operations. Can start, stop, pause, and manage snapshots, in addition to performing other operations on an environment.

See Also

Concepts

Configure initial groups, teams, members, and permissions

Permission reference for Team Foundation Server