CODEWITHSUNDEEP
azure-devopsdevopspull-request
paddingtonMike
paddingtonMike

Reputation: 1603

Only allow users under a certain AD Group to approve Pull Requests on Azure DevOps

On my organisation we use Azure DevOps and we have a repository where we want developers to be able to create pull requests with changes to it, but only develpers belonging to certain AD group to be able to approve them. What's the best way to achieve this in Azure DevOps?

According to Microsoft Documentation there is a permission called "Contribute to pull requests " which allows "Can create, comment on, and vote on pull requests." However, disabling this would mean that people cannot create pull requests. I want them to be able to create the pull request, just not able to approve them and complete them.

Upvotes: 1

Views: 4153

Answers (1)

LoLance
LoLance

Reputation: 28096

However, disabling this would mean that people cannot create pull requests. I want them to be able to create the pull request, just not able to approve them and complete them.

enter image description here

  1. If the Contribute is set to Deny, then the developer can review the code/create new branch/create PR/approve PR but can't push changes to master branch or branch not created by himself/complete PR. So this option can only partly meet your needs.

  2. Apart from above, a most recommended way in this scenario is to use Branch Policies.

    Since the original purpose is to avoid developers to complete the PR themselves, you can set both Require a minimum number of reviewers and Automatically Include reviewers options to meet your original needs:

    enter image description here

    enter image description here

    So that all the PRs in master branch can't be completed until it gets enough approvals from specific Group. (The group you're in, Project Administrators or what) Then the developers can create the PR, but the PR can only be completed by approvals from you(Team admins/managers?).

You can choose one of the above two options or combine them together to meet your needs.

In addition: If all above still can't meet your requirements very well, feel free to post your feature request in our User Voice forum, the Product Team would consider about your feedback. Follow the feedback and you can get notifications if there's any update.

Hope all above helps :)

Upvotes: 3

Related Questions