Skip to content

Commit 8c473c2

Browse files
Steve DanielsonSteve Danielson
Steve Danielson
authored and
Steve Danielson
committed
Merge branch 'main'
2 parents 264f494 + 587a10f commit 8c473c2

File tree

89 files changed

+1952
-609
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+1952
-609
lines changed

docs/organizations/security/about-security-roles.md

+11-11
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: About pipeline security roles
33
titleSuffix: Azure DevOps
4-
description: Learn about security roles and where they are used to manage select pipeline permissions
4+
description: Learn about security roles and where they're used to manage selected pipeline permissions.
55
ms.subservice: azure-devops-security
66
ms.author: chcomley
77
author: chcomley
@@ -10,62 +10,62 @@ monikerRange: '<= azure-devops'
1010
ms.date: 10/11/2021
1111
---
1212

13-
# About pipeline security roles
13+
# Pipeline security roles
1414

1515
[!INCLUDE [version-lt-eq-azure-devops](../../includes/version-lt-eq-azure-devops.md)]
1616

1717
<a id="security-roles"></a>
1818

19-
While the majority of features and functional tasks are managed by [individual permissions](about-permissions.md), there are several artifacts and features that the system manages through role-based permissions. You can add users or groups to a role. Each role determines the set of operations that the user can perform as described in the following sections.
19+
Security for both build and release pipelines, and task groups, is managed using [task-based permissions](about-permissions.md). Several pipeline resources have their security managed through role-based permissions. Roles can be assigned to users or groups. Each role determines the set of operations that a user can perform, as described in the following sections.
2020

21-
Many role-based permissions can be set for all artifacts of a specific type in a project, or for the project or collection and then selectively inherited for a specific artifact. Role memberships for individual items automatically inherit those set for the project or collection. If required, you can turn off Inheritance for a specific artifact.
21+
Role-based permissions are set for all resources of a specific type in a project or in an organization or collection. Individual resources inherit the permissions from the project-level settings. Inheritance can be turned off for an individual artifact if necessary.
2222

2323

2424
## Default role assignments
2525

26-
By default, all contributors in a project are members of the User role on each hosted queue. This allows every contributor in a project to author and run build and release pipelines using hosted queues.
26+
By default, all contributors in a project are members of the User role on each hosted queue. This role allows every contributor in a project to author and run build and release pipelines using hosted queues.
2727

2828
<a id="agent-queue-security-roles"></a>
2929

3030
## Agent pool security roles, project-level
3131

32-
You [add users to the following security roles](../../pipelines/policies/set-permissions.md) from the project-level admin context, **Agent Pools** page. For information on adding and managing agent pools, see [Agent pools](../../pipelines/agents/pools-queues.md).
32+
You [add users to the following security roles](../../pipelines/policies/agent-pool-permissions.md) from the project-level admin context, **Agent Pools** page. For information on adding and managing agent pools, see [Agent pools](../../pipelines/agents/pools-queues.md).
3333

3434
[!INCLUDE [temp](includes/agent-queue-roles.md)]
3535

3636
<a id="agent-pool-security-roles"></a>
3737

3838
## Agent pool security roles, organization or collection-level
3939

40-
You [add users to the following security roles](../../pipelines/policies/set-permissions.md) from the **Organization settings** or collection-level admin settings, **Agent Pools** page. For information on adding and managing agent pools, see [Agent pools](../../pipelines/agents/pools-queues.md).
40+
You [add users to the following security roles](../../pipelines/policies/agent-pool-permissions.md) from the **Organization settings** or collection-level admin settings, **Agent Pools** page. For information on adding and managing agent pools, see [Agent pools](../../pipelines/agents/pools-queues.md).
4141

4242
[!INCLUDE [temp](includes/agent-pool-roles.md)]
4343

4444
## Deployment group security roles
4545

46-
You [add users to the following roles](../../pipelines/policies/set-permissions.md) from **Pipelines** or **Build and Release**. For information on adding and managing deployment groups, see [Deployment groups](../../pipelines/release/deployment-groups/index.md).
46+
You [add users to the following roles](../../pipelines/policies/deployment-group-permissions.md) from **Pipelines** or **Build and Release**. For information on adding and managing deployment groups, see [Deployment groups](../../pipelines/release/deployment-groups/index.md).
4747

4848
[!INCLUDE [temp](includes/deployment-group-roles.md)]
4949

5050
## Deployment pool security roles
5151

52-
You [add users to the following roles](../../pipelines/policies/set-permissions.md) from the collection-level admin context, **Deployment Pools** page. To create and manage deployment pools, see [Deployment groups](../../pipelines/release/deployment-groups/index.md).
52+
You [add users to the following roles](../../pipelines/policies/deployment-group-permissions.md) from the collection-level admin context, **Deployment Pools** page. To create and manage deployment pools, see [Deployment groups](../../pipelines/release/deployment-groups/index.md).
5353

5454
[!INCLUDE [temp](includes/deployment-pool-roles.md)]
5555

5656
<a id="library-roles"></a>
5757

5858
## Library asset security roles: Variable groups and secure files
5959

60-
You [add users to a library role](../../pipelines/policies/set-permissions.md) from **Pipelines** or **Build and Release**. To learn more about using these library assets, see [Variable groups](../../pipelines/library/variable-groups.md) and [Secure files](../../pipelines/library/secure-files.md)
60+
You [add users to a library role](../../pipelines/policies/library-permissions.md) from **Pipelines** or **Build and Release**. To learn more about using these library assets, see [Variable groups](../../pipelines/library/variable-groups.md) and [Secure files](../../pipelines/library/secure-files.md).
6161

6262
[!INCLUDE [temp](includes/library-roles.md)]
6363

6464
<a id="service-endpoint-roles"></a>
6565

6666
## Service connection security roles
6767

68-
You [add users to the following roles](../../pipelines/policies/set-permissions.md) from the project-level admin context, **Services** page. To create and manage these resources, see [Service connections for build and release](../../pipelines/library/service-endpoints.md).
68+
You [add users to the following roles](../../pipelines/policies/service-connection-permissions.md) from the project-level admin context, **Services** page. To create and manage these resources, see [Service connections for build and release](../../pipelines/library/service-endpoints.md).
6969

7070
[!INCLUDE [temp](includes/service-endpoint-roles.md)]
7171

docs/organizations/security/data-protection.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.subservice: azure-devops-security
88
ms.author: chcomley
99
author: chcomley
1010
ms.reviewer: jominana
11-
ms.date: 04/19/2024
11+
ms.date: 05/28/2024
1212
monikerRange: 'azure-devops'
1313
---
1414
# Data protection overview
@@ -184,7 +184,7 @@ We encrypt data via HTTPS and SSL to help ensure that it isn't intercepted or mo
184184
- Azure Blob Storage connections are encrypted to help protect your data in transit. For data at rest stored in Azure Blob Storage, Azure DevOps uses [service-side encryption](/azure/storage/common/storage-service-encryption).
185185

186186
> [!NOTE]
187-
> Azure DevOps is not Federal Information Processing Standards (FIPS) 140-2 or 140-3 compliant.
187+
> Azure DevOps is Federal Information Processing Standards (FIPS) 140-2 or 140-3 compliant.
188188
189189
The Azure DevOps team uses the Azure infrastructure to log and monitor key aspects of the service. Logging and monitoring help ensure that activities within the service are legitimate, and they help detect breaches or attempted breaches.
190190

docs/organizations/security/download-permissions-report-release.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ ms.date: 07/07/2022
1515
[!INCLUDE [version-eq-azure-devops](../../includes/version-eq-azure-devops.md)]
1616

1717

18-
To determine the effective permissions of users and groups for a release, you can download the permissions report. Requesting the report generates an email with a link to download the report. The report lists the effective permissions for the release you select, for each user and group specified at the time the report is generated. Inherited permissions come from a parent group which you can view from the web portal. The report is a json-formatted report that you can open using Power BI or other json reader.
18+
To determine the effective permissions of users and groups for a release, you can download the permissions report. Requesting the report generates an email with a link to download the report. The report lists the effective permissions for the release you select, for each user and group specified at the time the report is generated. Inherited permissions come from a parent group that you can view from the web portal. The report is a json-formatted report that you can open using Power BI or other json reader.
1919

2020
You can also use the [Permissions Report REST API](/rest/api/azure/devops/permissionsreport/?view=azure-devops-rest-6.1&preserve-view=true) to download the report.
2121

2222
## Prerequisites
2323

24-
- To download the permissions report, you must be a member of the **Project Collection Administrators** group. The user interface button won't appear for users who aren't a member of this group.
24+
- To download the permissions report, you must be a member of the **Project Collection Administrators** group. The user interface button doesn't appear for users who aren't a member of this group.
2525

2626
To find a member of the **Project Collection Administrators** group, see [Look up a project collection administrator](look-up-project-collection-administrators.md).
2727

@@ -53,7 +53,7 @@ You can download the report for a specific release from the release's Security d
5353

5454
## Related articles
5555

56-
- [Set different levels of pipeline permissions](../../pipelines/policies/permissions.md)
56+
- [Set different levels of pipeline permissions](../../pipelines/policies/pipeline-permissions.md)
5757
- [Manage permissions with command line tool](manage-tokens-namespaces.md)
5858
- [Permissions Report REST API](/rest/api/azure/devops/permissionsreport/?view=azure-devops-rest-6.1&preserve-view=true)
5959

docs/organizations/security/includes/library-roles.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
> [!div class="mx-tdCol2BreakAll"]
44
> | Role | Description |
55
> |------------|-------------|
6-
> | **Administrator** | Can edit/delete and manage security for library items. |
7-
> | **Creator** | Can create library items. |
8-
> | **Reader** | Can only read library items. |
9-
> | **User** | Can consume library items in pipelines. |
6+
> | **Administrator** | Can edit/delete and manage security for library assets. The creator of an asset is automatically given this role for the asset.|
7+
> | **Creator** | Can create library assets. |
8+
> | **Reader** | Can only read library assets. |
9+
> | **User** | Can consume library assets in pipelines. |

docs/organizations/security/includes/pipelines-build.md

+15-15
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ ms.date: 08/18/2021
1313

1414

1515

16-
| Task | Readers | Contributors | Build Admins | Project Admins |
17-
|-------------------------|---------|--------------|--------------|----------------|
18-
| View builds | ✔️ | ✔️ | ✔️ | ✔️ |
19-
| View build pipeline | ✔️ | ✔️ | ✔️ | ✔️ |
20-
| Administer build permissions| | | ✔️ | ✔️ |
21-
| Delete or edit build pipeline| | ✔️ | ✔️ | ✔️ |
22-
| Delete or destroy builds | | | ✔️ | ✔️ |
23-
|Edit build quality | | ✔️ | ✔️ | ✔️ |
24-
|Manage build qualities | | | ✔️ | ✔️ |
25-
|Manage build queue | | | ✔️ | ✔️ |
26-
|Override check-in validation by build| | | | ✔️ |
27-
|Queue builds | | ✔️ | ✔️ | ✔️ |
28-
|Retain indefinitely | ✔️| ✔️ | ✔️ | ✔️ |
29-
|Stop builds | ||✔️|✔️|
30-
|Update build information ||||✔️|
16+
| Task | Readers | Contributors | Build Admins | Project Admins |
17+
|------|:-------:|:------------:|:------------:|:--------------:|
18+
| View builds |✔️|✔️|✔️|✔️|
19+
| View build pipeline |✔️|✔️|✔️|✔️|
20+
| Administer build permissions| | |✔️|✔️|
21+
| Delete or edit build pipeline| |✔️|✔️|✔️|
22+
| Delete or destroy builds | | |✔️|✔️|
23+
|Edit build quality | |✔️|✔️|✔️|
24+
|Manage build qualities | | |✔️|✔️|
25+
|Manage build queue | | |✔️|✔️|
26+
|Override check-in validation by build| | | |✔️|
27+
|Queue builds | |✔️|✔️|✔️|
28+
|Retain indefinitely |✔️|✔️|✔️|✔️|
29+
|Stop builds | | |✔️|✔️|
30+
|Update build information | | | |✔️|

docs/organizations/security/includes/pipelines-release.md

+13-13
Original file line numberDiff line numberDiff line change
@@ -20,19 +20,19 @@ View releases
2020
-->
2121

2222

23-
| Task | Stakeholders | Readers | Contributors | Project Admins | Release Admins |
24-
|-------------------------|---------------|----------|---------------|-------------|----------------|
25-
| Approve releases | ✔️ | | ✔️ | ✔️ | ✔️ |
26-
| View releases | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
27-
| View release pipeline | | ✔️ | ✔️ | ✔️ | ✔️ |
28-
| Administer release permissions | | | | ✔️ | ✔️ |
29-
| Delete release pipeline or stage | | | ✔️ | ✔️ | ✔️ |
30-
| Delete releases | | | ✔️ | ✔️ | ✔️ |
31-
| Edit release pipeline | | | | ✔️ | ✔️ |
32-
| Edit release stage | | | ✔️ | ✔️ | ✔️ |
33-
| Manage deployments | | | | ✔️ | ✔️ |
34-
| Manage release approvers | | | ✔️ | ✔️ | ✔️ |
35-
| Manage releases | | | | ✔️ | ✔️ |
23+
| Task | Stakeholders | Readers | Contributors | Project Admins | Release Admins |
24+
|------|:------------:|:-------:|:------------:|:--------------:|:--------------:|
25+
| Approve releases |✔️| |✔️|✔️|✔️|
26+
| View releases |✔️|✔️|✔️|✔️|✔️|
27+
| View release pipeline | |✔️|✔️|✔️|✔️|
28+
| Administer release permissions | | | |✔️|✔️|
29+
| Delete release pipeline or stage | | |✔️|✔️|✔️|
30+
| Delete releases | | |✔️|✔️|✔️|
31+
| Edit release pipeline | | | ✔️|✔️|✔️|
32+
| Edit release stage | | |✔️|✔️|✔️|
33+
| Manage deployments | | | ✔️|✔️|✔️|
34+
| Manage release approvers | | |✔️|✔️|✔️|
35+
| Manage releases | | |✔️|✔️|✔️|
3636

3737

3838

docs/organizations/security/includes/task-groups.md

+5-5
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ Edit task group
1515
1616
-->
1717

18-
|Task|Readers|Contributors|Build Admins|Project Admins|Release Admins|
19-
|----|-------|------------|------------|--------------|--------------|
20-
|Administer task group permissions| | |✔️|✔️|✔️|
21-
|Delete task group| | |✔️|✔️|✔️|
22-
|Edit task group| | |✔️|✔️|✔️|
18+
|Task |Readers|Contributors|Build Admins|Project Admins|Release Admins|
19+
|---- |:-------:|:------------:|:------------:|:--------------:|--------------|
20+
|Administer task group permissions| | |✔️ |✔️ |✔️ |
21+
|Delete task group | | |✔️ |✔️ |✔️ |
22+
|Edit task group | |✔️ |✔️ |✔️ |✔️ |

0 commit comments

Comments
 (0)