Allow create and edit build definition, but not edit existing definitions

Question

I manage a large TFS 2013 team project, whose code we're now splitting into multiple independent parts, each part becoming a tenant in the team project. Each such part would have its own build definition(s). I want people in each part to be able to create/edit/manage their build definitions, but not others.

Currently, I create the build definitions myself upon request, and then set permissions on the new definitions, and tell people to edit them. I have permissions to that since I'm in the Builders VSO group, and therefore have Edit build definition and Administrator build permissions on the Team project.

However, I'd like to grant everyone the permission to create new build definitions and administer them, but not have permissions to change other permissions. Is this possible in TFS?

I don't think it is possible at the moment - I have similar problems, and usually for me it comes down to trust of the persons, as to whether I make them "Builders". The problem with this approach is the lack of audit on who changes a build in TFS if something does happen to a build. — DaveShaw

MrHinsh - Martin Hinshelwood MrHinsh - Martin Hinshelwood · Accepted Answer · 2014-12-22T13:43:17

Its not currently possible to do that out of the box. However, you could setup a webpage that automated the task that you currently perform and add a new build definition and give permission to the correct team... Then they can manage it from then.

I would recommend using PowerShell for the action and the webpage mearly calls that.

Allow create and edit build definition, but not edit existing definitions

1 Answers