How to: Extract Pipeline (Build and Release) Permissions from the respective user, and project

This script and report extract Pipeline Permissions from the user. Before that, it’s necessary to get all groups to which that user belongs.

DISCLAIMER: Due to the number of records generated by this report, two mandatory filters were placed: the name of the user and the name of Team Project. This report was based on the ALM Rangers project Extracting effective permissions from TFS

An original script is available on my GitHub repository. See below this script:

Let’s go understand each command used.

1. PowerShell script will receive the following parameters:

• $PAT = Personal Access token to connect on Azure DevOps;
• $Organization = Organization URL to list permissions on (Builds and Releases) Pipelines;
• ProjectName = Team Project name that contains Pipelines to which permissions will be extracted;
• mailAdress = e-mail from respective user to which permissions will be extracted;
• $Connstr = connection string to Azure SQL Database to store the report information. To create this report, it’s necessary to create previously a Azure SQL Server and Database and run a script below:

2. az devops user list = use this command to list all users on Azure DevOps organization. After that, it’s necessary to filter a respective user that was received by parameter.

$allUsers = az devops user list 
--org $Organization | ConvertFrom-Json
$allUsers = $allUsers.members 
$allUsers = $allusers.user | where-object {$_.mailAddress -eq $mailAddress}

3. az devops project list = use this command to list all projects on Azure DevOps organization. After that, it’s necessary to filter a respective Team Project that was received by parameter.

$allProjects = az devops project list
--org $Organization
--top 500 | ConvertFrom-Json
$allProjects = $allProjects.value | Where name -EQ $ProjectName

4. az devops security group membership list = use this command to list all groups that user (received by parameter) is contained in.

$activeUserGroups = az devops security group membership list 
--id $allUsers.principalName 
--org $Organization 
--relationship memberof | ConvertFrom-Json

5. In Azure DevOps, when working with permissions, it’s necessary to understand SecurityNameSpaces. Basically, each namespace represents the respective set of permissions on Azure DevOps (Git, Area Path, Project Level, Iterations, Builds, Releases, etc.). In this example, will be used namespaces ReleaseManagement, and Build, which is represented by the constants below:

$SecurityNameSpaceIds = @(       
[pscustomobject]@{
SecurityNameSpace='ReleaseManagement';
SecurityIdSpace='c788c23e-1b46-4162-8f5e-d7585343b5de';
PermissionType='Release'}
       
[pscustomobject]@{
SecurityNameSpace='Build';
SecurityIdSpace='33344d9c-fc72-4d6f-aba5-fa317101a7e9';
PermissionType='Build'}
)

6. Token = At the moment that we extract any kind of permission on Azure DevOps, it’s necessary to work with tokens. For each type of permission, there is a specific rule to produce that token. In the specific case of Build, and Release permissions, the rule below is valid:

$PipelineToken = "$($allProjects.id)"

• Team Project ID = ID of a respective Team Project;

7. More details about other tokens, can be found in the links below:

• Security tokens for Permissions management;
• Security namespace and permission reference for Azure DevOps

8. az devops security permission show = Show details of permissions available in each namespace

$PipelineCommands = az devops security permission show
--id $snsi.SecurityIdSpace 
--subject $activeUserGroups.$aug.descriptor 
--token $PipelineToken --org $Organization | ConvertFrom-Json

9. After extract all permissions, this information is stored in a table in Azure SQL.

10. After insert information into a table, I connected this database on Power BI:

• Permission Type (1) = Build or Release;
• Azure DevOps Groups (2) = list all Azure DevOps groups to which the user belongs;
• Command (3) = List of commands available to Pipeline (Build or Release);
• Permission (4) = Permission type (Allow, Deny, Not set, etc.).