How to: Extract Git Permissions from the respective user and repositories

This script and report extract Git Permissions from user. Before that, it’s necessary to get all groups to which that user belongs.

DISCLAIMER: Due to the number of records generated by this report, two mandatory filters were placed: the name of the user and the name of Team Project. This report was based on the ALM Rangers project Extracting effective permissions from TFS

An original script is available on my GitHub repository. See below this script:

Let’s go understand each command used.

1. PowerShell script will receive the following parameters:

• $PAT = Personal Access token to connect on Azure DevOps;
• $Organization = Organization URL to list permissions on Git repositories;
• ProjectName = Team Project name that contains repositories to which permissions will be extracted;
• mailAdress = e-mail from respective user to which permissions will be extracted;
• $Connstr = connection string to Azure SQL Database to store the report information. To create this report, it’s necessary to create previously a Azure SQL Server and Database and run a script below:

2. az devops user list = use this command to list all users on Azure DevOps organization. After that, it’s necessary to filter a respective user that was received by parameter.

$allUsers = az devops user list 
--org $Organization | ConvertFrom-Json
$allUsers = $allUsers.members 
$allUsers = $allusers.user | where-object {$_.mailAddress -eq $mailAddress}

3. az devops project list = use this command to list all projects on Azure DevOps organization. After that, it’s necessary to filter a respective Team Project that was received by parameter.

$allProjects = az devops project list 
--org $Organization --top 500 | ConvertFrom-Json
$allProjects = $allProjects.value | Where name -EQ $ProjectName

4. az repos list = use this command to list all repositories to a respective Team Project that was received by parameter.

$allrepos = az repos list 
--org $Organization 
--project $allProjects.id | ConvertFrom-Json
Foreach ($ar in $allrepos)
{
    Write-Host $ar.name
}

5. az devops security group membership list = use this command to list all groups that user (received by parameter) is contained in.

$activeUserGroups = az devops security group membership list 
--id $allUsers.principalName 
--org $Organization 
--relationship memberof | ConvertFrom-Json

6. In Azure DevOps, when working with permissions, it’s necessary to understand SecurityNameSpaces. Basically, each namespace represents the respective set of permissions on Azure DevOps (Git, Area Path, Project Level, Iterations, etc.). In this example, will be used namespace “Git Repositories”, that which is represented by the constant below:

$SecurityNameSpaceIdGitRepositories = "2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87"

7. Token = At the moment that we extract any kind of permission on Azure DevOps, it’s necessary to work with tokens. For each type of permission, there is a specific rule to produce that token. In the specific case of Git permissions, the rule below is valid:

$gitToken = "repoV2/$($allProjects.id)/$($ar.id)"

• repoV2 = it’s a constant to extract Git Permissions;
• Team Project ID = ID of a respective Team Project;
• Repo ID = ID of a respective Git repository.

8. More details about other tokens, can be found in the links below:

• Security tokens for Permissions management;
• Security namespace and permission reference for Azure DevOps

9. az devops security permission show = Show details of permissions available in each namespace

$gitCommands = az devops security permission show 
--id $SecurityNameSpaceIdGitRepositories 
--subject $activeUserGroups.$aug.descriptor 
--token $gitToken 
--org $Organization | ConvertFrom-Json

10. After extract all permissions, this information is stored in a table in Azure SQL.

11. After insert information into a table, I connected this database on Power BI:

• Repository (1) = Select repository name that will be shown respective Git Permissions;
• Azure DevOps Groups (2) = list all Azure DevOps groups to which the user belongs;
• Command (3) = List of commands available to Git repositories;
• Permission (4) = Permission type (Allow, Deny, Not set, etc.).

One more time, I wanted to thank Ewerton Rodrigues Jordão for the great help with PowerShell and Willy-Peter Schaub for great ideas with new reports.