Which permission allows a user to create Task Groups in TFS 2017 Build?

Question

When I try to create a task group from a task in my build definition in TFS 2017, I get an error that says

Access denied. (user name) needs Edit task group permissions to perform the action. For more information, contact the Team Foundation Server administrator.

I've checked the following documentation pages, but none of them seem to mention how to grant edit task group permission:

• Task Groups
• Permissions and groups in VSTS and TFS
• Build and release permissions

I'd like to know the correct way to grant this permission.

Additional information: My account is a member of a Builders group in the appropriate project, and that Builders group has Allow set for every permission listed at the above Build and release permissions link, except override check-in validation by build and Update build information which are both Not Set, and the documentation recommends leaving those permissions as they are.

Answer 1

There are three related permission Administer task group permissions, Delete task group, Edit task group for task groups configuration.

You could set it from Build&Release --Task Group--right click it in left pane--select security.

However just like some other permission settings, you could also directly add a user or TFS group here. After add a user, there should be a users list under TFS group list.

"Build Administrators", "Contributors","Project Administrators" or "Release Administrators" there are just four default groups here. You don't have to add your user account in these groups and set the permission for a specific group to grant related permission of "task group". For example, if you don't want to give all users in a group the correspondingly permission, you could simply give the permission for a user.

In your case, you could add your old "Builders" group here or just add your owner account either directly here or one of a default group.

Answer 2

The other answer is good, except that I have no Builders group... perhaps due to the upgrade path that had been followed on that server.

Go to Task Groups hub, e.g. http://{server}:8080/tfs/{collection}/{project}/_apps/hub/ms.vss-releaseManagement-web.hub-metatask, and hover on Task Groups in left pane, click Ellipsis and choose Security. By default, the old Builders group is not in there, but Build Administrators is. The permission Edit task group can be set here, if needed, but it looks like the correct thing to do is add the user to one of the groups Build Administrators, Project Administrators or Release Administrators.