Security namespace and permission reference for Azure DevOps

Description

Manages build permissions at the project-level and object-level.

Token format for project-level build permissions: PROJECT_ID
If you need to update permissions for a particular build definition ID, for example, 12, security token for that build definition looks as follows:
Token format for project-level, specific build permissions: PROJECT_ID/12
Example: xxxxxxxx-a1de-4bc8-b751-188eea17c3ba/12

ID: 33344d9c-fc72-4d6f-aba5-fa317101a7e9

Manages area path object-level permissions to create, edit, and delete child nodes and set permissions to view or edit work items in a node. You can manage these permissions through the Set permissions and access for work tracking, Create child nodes, modify work items under an area path.

ID: 83e28ad4-2d72-4ceb-97b0-c7726d5502c3

Manages dashboard object-level permissions to edit and delete dashboards and manage permissions for a project dashboard. You can manage these permissions through the Dashboards user interface.

ID: 8adf73b7-389a-4276-b638-fe1653f7efc7

Manages Git repository permissions at the project-level and object-level. You can manage these permissions through the Project settings, Repositories administrative interface.

The Administer permission was divided into several more granular permissions in 2017, and should not be used.
Token format for project-level permissions: repoV2/PROJECT_ID
You need to append RepositoryID to update repository-level permissions.

Token format for repository-specific permissions: repoV2/PROJECT_ID/REPO_ID

ID: 2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87

Manages iteration path object-level permissions to create, edit, and delete child nodes and view child node permissions. To manage through the web portal, see Set permissions and access for work tracking, Create child nodes.
Token format: 'vstfs:///Classification/Node/Iteration_Identifier/'
Suppose, you have the following iterations configured for your team.
– ProjectIteration1
  TeamIteration1
     – TeamIteration1ChildIteration1
     – TeamIteration1ChildIteration2
     – TeamIteration1ChildIteration3
  TeamIteration2
     – TeamIteration2ChildIteration1
     – TeamIteration2ChildIteration2

To update permissions for ProjectIteration1\TeamIteration1\TeamIteration1ChildIteration1, the security token looks as follows:
vstfs:///Classification/Node/ProjectIteration1_Identifier:vstfs:///Classification/Node/TeamIteration1_Identifier:vstfs:///Classification/Node/TeamIteration1ChildIteration1_Identifier

ID: bf7bfa03-b2b7-47db-8113-fa2e002cc5b1

Manages task group permissions to edit and delete task groups, and administer task group permissions. To manage through the web portal, see Pipeline permissions and security roles, Task group permissions.

Token format for project-level permissions: PROJECT_ID
Token format for metaTask-level permissions: PROJECT_ID/METATASK_ID

If MetaTask has parentTaskId then the Security token looks as follows:
Token Format: PROJECT_ID/PARENT_TASK_ID/METATASK_ID

ID: f6a4de49-dbe2-4704-86dc-f8ec1a294436

Manages permissions for Delivery Plans to view, edit, delete, and manage delivery plans. You can manage these permissions through the web portal for each plan.

ID: bed337f8-e5f3-4fb9-80da-81e17d06e7a8

Manages release definition permissions at the project and object-level.

Token format for project-level permissions: PROJECT_ID
Example: xxxxxxxx-a1de-4bc8-b751-188eea17c3ba
If you need to update permissions for a particular release definition ID, for example, 12, security token for that release definition looks as follows:

Token format for specific release definition permissions: PROJECT_ID/12
Example: xxxxxxxx-a1de-4bc8-b751-188eea17c3ba/12
If the release definition ID lives in a folder, then the security tokens look as follows:
Token format: PROJECT_ID/{folderName}/12
For stages, tokens look like: PROJECT_ID/{folderName}/{DefinitionId}/Environment/{EnvironmentId}.

ID: c788c23e-1b46-4162-8f5e-d7585343b5de

Manages permissions for work item queries and query folders. To manage these through the web portal, see Set permissions and access for work tracking, Set permissions on queries or query folders.

ID: 71356614-aad7-4757-8f2c-0fb3bff6f680

Description

Manages Project-level permissions.
The AGILETOOLS_BACKLOG permission manages access to Azure Boards backlogs. This is an internal permission setting and shouldn't be changed.

Root token format: $PROJECT
Token to secure permissions for each project in your organization.
$PROJECT:vstfs:///Classification/TeamProject/PROJECT_ID.
Assume you have a project named Test Project 1.
You can get the project ID for this project by using the az devops project show command.
az devops project show --project "Test Project 1"
The command returns a project-id, for example, xxxxxxxx-a1de-4bc8-b751-188eea17c3ba.
Therefore, the token to secure project-related permissions for Test Project 1 is:
'$PROJECT:vstfs:///Classification/TeamProject/xxxxxxxx-a1de-4bc8-b751-188eea17c3ba'

ID: 52d39943-cb85-4d7f-8fa8-c6baac873819

Manages permissions to create, delete, enumerate, and use work item tags. You can manage the Create tag definition permission through the Project settings, Permissions administrative interface.

Token format for project-level permissions: /PROJECT_ID
Example: /xxxxxxxx-a1de-4bc8-b751-188eea17c3ba

ID: bb50f182-8e5e-40b8-bc21-e8752a1e7ae2

Manages permissions for a Team Foundation Version Control (TFVC) repository. There is only one TFVC repository for a project. You can manage these permissions through the Project settings, Repositories administrative interface.

ID: a39371cf-0841-4c16-bbd3-276e341bc052

Description

Manages access to view, manage, use, or administer permissions for build resources.

ID: 302acaca-b667-436d-a946-87133492041c

Manages permissions at the organization or collection-level.

ID: 3e65f728-f8bc-4ecd-8764-7e378b19bfa7

Manages permissions for administering shelved changes, workspaces, and the ability to create a workspace at the organization or collection level. The Workspaces namespace applies to the TFVC repository.

Root token format: /
Token format for a specific workspace: /{workspace_name};{owner_id}

ID: 93bafc04-9075-403a-9367-b7164eac6b5c

Manages permissions for Team Foundation Version Control (TFVC) repository.

The AdminConfiguration permission grants users the ability to edit server-level permissions for users and groups. The AdminConnections permission grants users the ability to read the contents of a file or folder of an on-premises, server-level repository. ID: 66312704-deb5-43f9-b51c-ab4ff5e351c3

Description

Manages permissions set at the server-level to create and delete project collections.

ID: 52d39943-cb85-4d7f-8fa8-c6baac873819

Manages permissions set at the server-level. This includes permissions to edit instance-level information, make requests on behalf of others, and trigger events.

ID: 1f4179b3-6bac-4d01-b421-71ea09171400

Grants permission to process or change settings for the data warehouse or SQL Server Analysis cube by using the Warehouse Control Web Service.

ID: b8fbab8b-69c8-4cd9-98b5-873656788efb

Description

Manages permissions to access agent pool resources. By default, the following roles and permissions are assigned at the project level and inherited for each agent pool that is created:

• Reader role (View permissions only) to all members of the Project Valid Users group
• Administrator role (all permissions) to members of the Build Administrators, Project Administrators, and Release Administrators groups.
• User role (View, Use, and Create permissions) to all members of the Contributor group
• Creator role (View, Use, and Create permissions) to all members of the Contributor group
  
  ID: 101eae8c-1709-47f9-b228-0e476c35b3ba

Manages permissions to create and manage Environments. By default, the following permissions are assigned:

• Reader role (View permissions only) to all members of the Project Valid Users group
• Creator role (View, Use, and Create permissions) to all members of the Contributor group
• Creator role (View, Use, and Create permissions) to all members of the Project Administrators group
• Administrator role (all permissions) to the user who created a specific Environment.
  
  ID: 83d4c2e6-e57d-4d6e-892b-b87222b7ad20

The Manager role is the only role used to manage the security of Marketplace extensions. Members of the Manager role can install extensions and respond to requests for extensions to be installed. The other permissions are assigned automatically to members of default security groups and service principals. To add users to the Manager role, see Manage extension permissions.

ID: 5d6d7b80-3c63-4ab0-b699-b6a5910f8029

Manages permissions to create and manage library items, which include secure files and variable groups. Role memberships for individual items are automatically inherited from those of the Library node. By default, the following permissions are assigned:

• Reader role (View permissions only) to all members of the Project Valid Users group and the Project Collection Build Service account
• Creator role (View, Use, and Create permissions) to all members of the Contributors group
• Creator role (View, Use, Create, and Owner permissions) to the member who created the library item
• Administrator role (all permissions) to members of the Build Administrators, Project Administrators, and Release Administrators groups.
  To learn more, see Library asset security roles.
  
  ID: b7e84409-6553-448a-bbb2-af228e07cbeb

Manages permissions to create and manage service connections. Role memberships for individual items are automatically inherited from those defined at the project-level. By default, the following roles are assigned:

• Reader role (View permissions only) to all members of the Project Valid Users group and the Project Collection Build Service account
• Creator role (View, Use, and Create permissions) to members of the Endpoint Creators service security group.
• Administrator role (all permissions) to members of the Endpoint Administrators service security group.
  Roles are assigned through Service connection security roles.
  
  ID: 49b48001-ca20-4adc-8111-5b60c903a50c

Description

Manages permissions to read or modify the organization account owner. These permissions are assigned to the organization owner and members of the Project Collection Administrator group.

ID: 11238e09-49f2-40c7-94d0-8f0307204ce4

Sets permissions to read, delete, create, and manage the security of the data store. These permissions are assigned to several Azure DevOps service principals.

ID: 19F9F97D-7CB7-45F7-8160-DD308A6BD48E

Manages permissions and access to Kanban boards.

ID: 251e12d9-bea3-43a8-bfdb-901b98c0125e

Grants read and write access for notification handler.

ID: 7cd317f2-adc6-4b6c-8d99-6074faeaf173

Grants read and write access for notification subscribers.

ID: 2bf24a2b-70ba-43d3-ad97-3d9e1f75622f

Manages member permissions to view, edit, and unsubscribe from notifications or create a SOAP subscription.

ID: 58b176e7-3411-457a-89d0-c6d0ccb3c52b

Manages permissions to read, write, and delete user account identity information; manage group membership and create and restore identity scopes. The ManageMembership permission is automatically granted to members of the Project Administrators and Project Collection Administrators groups.

Token format for project-level permissions: PROJECT_ID
Example: xxxxxxxx-a1de-4bc8-b751-188eea17c3ba
To modify group level permissions for Group Origin ID [2b087996-2e64-4cc1-a1dc-1ccd5e7eb95b]:
Token: xxxxxxxx-a1de-4bc8-b751-188eea17c3ba\2b087996-2e64-4cc1-a1dc-1ccd5e7eb95b

ID: 5a27515b-ccd7-42c9-84f1-54c998f03866

Manages the ability to view, add, modify, and remove license levels. These permissions are automatically granted to members of the Project Collection Administrators groups.

ID: 453e2db3-2e81-474f-874d-3bf51027f2ee

Manages the ability to create and download permission reports.

ID: 25fb0ed7-eb8f-42b8-9a5e-836a25f67e37

Manages permissions to read and write pipeline cache entries. These permissions are only assigned to internal Azure DevOps service principles.
ID: 62a7ad6b-8b8d-426b-ba10-76a7090e94d5

Manages access to Release Management user interface elements.

ID: 7c7d32f7-0e86-4cd6-892e-b35dbba870bd

Manages permissions to view, edit, and delete service hook subscriptions and publish service hook events. These permissions are automatically assigned to members of the Project Collection Administrators group. DeleteSubscriptions is no longer used; EditSubscriptions can delete service hooks.

ID: cb594ebe-87dd-4fc9-ac2c-6a10a4c92046

Manages permissions for administrating work tracking and destroying attachments.
ID: 445d2788-c5fb-4132-bbef-09c4045ad93f

Manages permissions for changing work tracking processes and managing link types. The WorkItemTrackingProvision namespace is an older security namespace that is mostly used for TFS-2018 and earlier versions. The Process namespace replaces this namespace for managing processes in Azure DevOps Server 2019 and later versions.

Root token format: /$
Token format for a specific project: $/PROJECT_ID

ID: 5a6cd233-6615-414d-9393-48dbb252bd23

• CrossProjectWidgetView
• DataProvider
• Favorites
• Graph
• Identity2
• IdentityPicker
• Job
• Location
• ProjectAnalysisLanguageMetrics
• Proxy
• Publish
• Registry
• Security

• ServicingOrchestration
• SettingEntries
• Social
• StrongBox
• TeamLabSecurity
• TestManagement
• VersionControlItems2
• ViewActivityPaneSecurity
• WebPlatform
• WorkItemsHub
• WorkItemTracking
• WorkItemTrackingConfiguration