Appropriate access levels
Recommend appropriate access levels
Access level and permissions are different axes. Access level decides which features a user may use at all — it is a licensing question. Permissions decide what they may do with the things they can see.
Azure DevOps access levels
| Level | Gets |
|---|---|
| Stakeholder | Free. Work items, backlogs, dashboards, and approvals — but not code (Repos) or full Pipelines |
| Basic | Full access to Repos, Pipelines, Boards and Artifacts |
| Basic + Test Plans | Basic plus test management |
| Visual Studio subscriber | Entitlement via subscription |
Stakeholder is the answer whenever a scenario describes someone who needs visibility and sign-off but not code: a product owner tracking a backlog, a manager approving a release. It costs nothing, so assigning Basic to those people is pure waste — and grants code access they never needed.
GitHub
Outside collaborator is the parallel concept: repository-scoped access without organisation membership, correct for contractors and partners.
Reviewing regularly
Access levels drift upward. People are granted Basic during a project and keep it for years. Periodic review is part of the design, not an afterthought — and it is cheapest when access came from group membership rather than individual grants.
Primary sources