Quick Notes107 words
Permissions and security groups in Azure DevOps — quick notes
Azure DevOps permissions — quick notes
| Concept | Detail |
|---|---|
| Assign to | Groups, never individuals |
| Built-in groups | Readers · Contributors · Build Administrators · Project Administrators · Project Collection Administrators |
| States | Allow · Deny · Not set |
| Precedence | Deny beats Allow |
| Not set | Means inherit — not the same as Deny |
| Inheritance | Organisation → project → object |
| Separate scopes | Service connections, agent pools, variable groups, environments |
Trap: an explicit Deny blocks a user even when they are later added to an allowing group.