Skip to content

AzDoGroupPermission

Jump to bottom
Michael Zanatta edited this page Aug 13, 2026 · 1 revision

AzDoGroupPermission Resource

Description

The AzDoGroupPermission DSC resource manages permissions for groups in Azure DevOps. It allows you to grant or deny specific permissions to groups at various scopes (organization, project, or namespace level).

Syntax

AzDoGroupPermission [string] #ResourceName
{
    GroupName = [String] $GroupName
    PermissionName = [String] $PermissionName
    [ ProjectName = [String] $ProjectName ]
    [ Ensure = [String] {'Present', 'Absent'} ]
    [ Allow = [Boolean] ]
    [ Deny = [Boolean] ]
    [ DependsOn = [String[]] ]
    [ PsDscRunAsCredential = [PSCredential] ]
}

Properties

Key Properties (Required)

  • GroupName [String] - The name of the group to assign permissions to.

  • PermissionName [String] - The name of the permission to manage (e.g., 'Create Project', 'Read', 'Write').

Optional Properties

  • ProjectName [String] - The project name for project-level permissions. Omit for organization-level.

  • Ensure [String] - Desired state:

    • 'Present' - (default) Permission assignment should exist
    • 'Absent' - Permission assignment should be removed

  • Allow [Boolean] - Grant the permission ($true) or not ($false).

  • Deny [Boolean] - Explicitly deny the permission ($true) or not ($false).

Common Properties

  • DependsOn [String[]] - Dependencies on other resources.

  • PsDscRunAsCredential [PSCredential] - Credentials to run this resource under.

Return Values

  • GroupName - The group name
  • PermissionName - The permission name
  • ProjectName - The project (if applicable)
  • Allow - Whether permission is allowed
  • Deny - Whether permission is explicitly denied

Examples

Example 1: Grant Organization Permission to Group

Configuration GrantOrgPermission {
    Import-DscResource -ModuleName 'AzureDevOpsDscNative'
    
    Node localhost {
        AzDoOrganizationGroup 'AdminGroup' {
            Ensure          = 'Present'
            GroupName       = 'Administrators'
            GroupDescription = 'Organization admins'
        }
        
        AzDoGroupPermission 'AdminPermission' {
            Ensure          = 'Present'
            GroupName       = 'Administrators'
            PermissionName  = 'Create Project'
            Allow           = $true
            DependsOn       = '[AzDoOrganizationGroup]AdminGroup'
        }
    }
}

GrantOrgPermission
Start-DscConfiguration -Path ./GrantOrgPermission -Wait -Verbose

Example 2: Configure Multiple Permissions for Group

Configuration MultiplePermissions {
    Import-DscResource -ModuleName 'AzureDevOpsDscNative'
    
    Node localhost {
        AzDoOrganizationGroup 'Developers' {
            Ensure          = 'Present'
            GroupName       = 'Developers'
        }
        
        AzDoGroupPermission 'CreateProject' {
            Ensure          = 'Present'
            GroupName       = 'Developers'
            PermissionName  = 'Create Project'
            Allow           = $true
            DependsOn       = '[AzDoOrganizationGroup]Developers'
        }
        
        AzDoGroupPermission 'EditProject' {
            Ensure          = 'Present'
            GroupName       = 'Developers'
            PermissionName  = 'Edit Project Properties'
            Allow           = $true
            DependsOn       = '[AzDoOrganizationGroup]Developers'
        }
    }
}

MultiplePermissions
Start-DscConfiguration -Path ./MultiplePermissions -Wait -Verbose

Example 3: Deny Permission for Group

Configuration DenyPermission {
    Import-DscResource -ModuleName 'AzureDevOpsDscNative'
    
    Node localhost {
        AzDoOrganizationGroup 'Readers' {
            Ensure          = 'Present'
            GroupName       = 'Read Only Users'
        }
        
        AzDoGroupPermission 'DenyDelete' {
            Ensure          = 'Present'
            GroupName       = 'Read Only Users'
            PermissionName  = 'Delete Project'
            Deny            = $true
            DependsOn       = '[AzDoOrganizationGroup]Readers'
        }
    }
}

DenyPermission
Start-DscConfiguration -Path ./DenyPermission -Wait -Verbose

Example 4: Project-Level Permissions

Configuration ProjectPermission {
    Import-DscResource -ModuleName 'AzureDevOpsDscNative'
    
    Node localhost {
        AzDoProject 'MyProject' {
            Ensure              = 'Present'
            ProjectName         = 'MyProject'
            SourceControlType   = 'Git'
            ProcessTemplate     = 'Agile'
        }
        
        AzDoProjectGroup 'ProjectAdmins' {
            Ensure              = 'Present'
            ProjectName         = 'MyProject'
            GroupName           = 'Project Admins'
            DependsOn           = '[AzDoProject]MyProject'
        }
        
        AzDoGroupPermission 'ProjectAdminPerms' {
            Ensure              = 'Present'
            GroupName           = 'Project Admins'
            ProjectName         = 'MyProject'
            PermissionName      = 'Administer'
            Allow               = $true
            DependsOn           = '[AzDoProjectGroup]ProjectAdmins'
        }
    }
}

ProjectPermission
Start-DscConfiguration -Path ./ProjectPermission -Wait -Verbose

Important Notes

Permission Names

Common permission names include:

  • 'Create Project' - Create new projects
  • 'Delete Project' - Delete projects
  • 'Edit Project Properties' - Modify project settings
  • 'Administer' - Full administration permissions
  • 'Read' - Read access
  • 'Write' - Write access
  • 'Contribute' - Contribution permissions

Allow vs Deny

  • Allow: Explicitly grants the permission
  • Deny: Explicitly denies the permission
  • Setting both creates explicit deny (deny takes precedence)

Scope Levels

  • Organization-level: Omit ProjectName for org permissions
  • Project-level: Include ProjectName for project permissions
  • Namespace-level: For specialized permission management

Troubleshooting

Issue: "Permission Not Found"

Cause: The permission name doesn't exist or is misspelled

Solution:

  • Verify correct permission name
  • Check Azure DevOps documentation for valid permissions
  • Use proper capitalization

Issue: "Group Not Found"

Cause: The group doesn't exist

Solution:

  • Create the group first using AzDoOrganizationGroup or AzDoProjectGroup
  • Verify group name matches exactly

Related Resources

See Also

Clone this wiki locally