CODEWITHSUNDEEP
azureazure-devops
George Vovos
George Vovos

Reputation: 7618

Allow users to set branch policies but not Cross Repo Policies

Current situation (if I'm not missing anything)

  1. If Project settings --> Repos-->Repositories-> Git Repositories -> "Edit Policies" is allowed, users can edit Cross Repo Policies and add "local" policies to individual repos/branches

  2. If Project settings --> Repos-->Repositories-> Git Repositories -> "Edit Policies" is denied , users can't edit any kind of policies (Cross Repo or "local")

  3. If I want users to be able to edit "local" policies on specific repos/branches but not be able to edit Cross Repo Policies, I have to

    On "Git Repositories", set "Edit Policies" to Denied
    On each Repository, set "Edit Policies" to Allowed

Desired behavior
Is there a way to allow users to edit "Local" repository/branch policies without setting permissions on each individual repo?

Basically, I want to enforce the company wide "Cross Repo Policies" but allow teams to add additional policies own their own repos/branches if necessary.

Thanks

Upvotes: 0

Views: 523

Answers (1)

Levi Lu-MSFT
Levi Lu-MSFT

Reputation: 30313

The behavior you described in above current situation is by design, and it is easy to understand. For the permissions you set for Git Repositories are Cross Repo, they apply to all the repos in the project.

So that if you allow the edit policy permission for a user in Git Repositories level. He will be able to edit the Cross Repo Policies. If you deny the permission, he will not be edit any kind of policy.

When a user is added to a team group of the project. He will inherit the permission settings of this group. So you can set the Edit Policies permission to Not set for a user on Git Repositories level. He will inherit the permission set for the group which he is a member of.

If you want to enforce the company wide "Cross Repo Policies" but allow teams to add additional policies own their own repos/branches if necessary. You will need to set the Edit Policies permission to Deny on Git Repositories level and set the Edit Policies permission to allow on each repo level for each individual team group.

Check the steps here to add a team in azure devops.

Upvotes: 1

Related Questions