How to: Extract Project Level Permissions from the respective user, and project

This script and report extract Project Level Permissions from the user. Before that, it’s necessary to get all groups to which that user belongs.

DISCLAIMER: Due to the number of records generated by this report, two mandatory filters were placed: the name of the user and the name of Team Project. This report was based on the ALM Rangers project Extracting effective permissions from TFS. Within Azure DevOps, to access these same permissions, select a Team Project, click on Project Settings, click in Permissions, and select a respective group.

An original script is available on my GitHub repository. See below this script:

Let’s go understand each command used.

1. PowerShell script will receive the following parameters:

• $PAT = Personal Access token to connect on Azure DevOps;
• $Organization = Organization URL to list permissions on Project Level;
• ProjectName = Team Project name that contains Projects to which permissions will be extracted;
• mailAdress = e-mail from respective user to which permissions will be extracted;
• $Connstr = connection string to Azure SQL Database to store the report information. To create this report, it’s necessary to create previously a Azure SQL Server and Database and run a script below:

2. az devops user list = use this command to list all users on Azure DevOps organization. After that, it’s necessary to filter a respective user that was received by parameter.

$allUsers = az devops user list 
--org $Organization | ConvertFrom-Json
$allUsers = $allUsers.members 
$allUsers = $allusers.user | where-object {$_.mailAddress -eq $mailAddress}

3. az devops project list = use this command to list all projects on Azure DevOps organization. After that, it’s necessary to filter a respective Team Project that was received by parameter.

$allProjects = az devops project list
--org $Organization
--top 500 | ConvertFrom-Json
$allProjects = $allProjects.value | Where name -EQ $ProjectName

4. az devops security group membership list = use this command to list all groups that user (received by parameter) is contained in.

$activeUserGroups = az devops security group membership list 
--id $allUsers.principalName 
--org $Organization 
--relationship memberof | ConvertFrom-Json

5. In Azure DevOps, when working with permissions, it’s necessary to understand SecurityNameSpaces. Basically, each namespace represents the respective set of permissions on Azure DevOps (Git, Area Path, Project Level, Iterations, Builds, Releases, etc.). To this example, to represent permission on Project Level will be used namespaces Project, Tagging, AnalyticsViews, and Analytics, which is represented by the constants below:

$SecurityNameSpaceIds = @(    
[pscustomobject]@{
SecurityNameSpace='Project';
SecurityIdSpace='52d39943-cb85-4d7f-8fa8-c6baac873819'}    
[pscustomobject]@{
SecurityNameSpace='Tagging';
SecurityIdSpace='bb50f182-8e5e-40b8-bc21-e8752a1e7ae2'}    
[pscustomobject]@{
SecurityNameSpace='AnalyticsViews';
SecurityIdSpace='d34d3680-dfe5-4cc6-a949-7d9c68f73cba'}    
[pscustomobject]@{
SecurityNameSpace='Analytics';
SecurityIdSpace='58450c49-b02d-465a-ab12-59ae512d6531'}
)

6. Token = At the moment that we extract any kind of permission on Azure DevOps, it’s necessary to work with tokens. For each type of permission, there is a specific rule to produce that token. For each namespace, there is specific rule:

• Project = $PROJECT:vstfs:///Classification/TeamProject/PROJECT_ID

'Project' { $Token = "`$PROJECT:vstfs:///Classification/TeamProject/$($allProjects.id)" }

• Tagging = /PROJECT_ID

'Tagging' { $Token = "/$($allProjects.id)" }

• AnalyticsView = $/Shared/PROJECT_ID

'AnalyticsViews' { $Token = "`$/Shared/$($allProjects.id)" }                

• Analytics = $/PROJECT_ID

'Analytics' { $Token = "`$/$($allProjects.id)" }

7. More details about other tokens, can be found in the links below:

• Security tokens for Permissions management;
• Security namespace and permission reference for Azure DevOps

8. az devops security permission show = Show details of permissions available in each namespace

$projectCommands = az devops security permission show 
--id $snsi.SecurityIdSpace 
--subject $activeUserGroups.$aug.descriptor 
--token $Token 
--org $Organization | ConvertFrom-Json

9. After extract all permissions, this information is stored in a table in Azure SQL.

10. After insert information into a table, I connected this database on Power BI:

• Azure DevOps Groups (1) = Filter Azure DevOps Groups to which the user belongs;
• Azure DevOps Groups (2) = list all Azure DevOps groups to which the user belongs;
• Permission Group Type (3) = List of Permission Group Type (Analytics, Boards, General, Test Plans);
• Command (4) = List of commands available to Project Level;
• Permission (5) = Permission type (Allow, Deny, Not set, etc.).