Group Permission for Azure DevOps via CLI

Question

I would like to remove the DELETE (Delete Project) permission from the Project Administrator role for each project in Azure DevOps. Here are the CLI commands that I am running. Everything goes without errors. However, when you go back and check on the web, the permissions are untouched. Any ideas?

$org = "myOrg"
$orgUrl = "https://dev.azure.com/$org"

$projName = "myProject"
$group = "Project Administrators"

$projId = az devops project list --org "$orgURl" -o json --query "value[[email protected] == '$projName'].id | [0]"
$projToken = '$PROJECT:vstfs///Classification/TeamProject/'+$projId
$projToken = $projToken -Replace '"', ""

$subject = az devops security group list --org "$orgUrl" --scope organization -o json --subject-types vssgp --query "graphGroups[[email protected] == '[$projName]\$group'].descriptor | [0]"

$namespaceId = az devops security permission namespace list -o json --org "$orgUrl" --query "[[email protected] == 'Project'].namespaceId | [0]"

$bit = az devops security permission namespace show -o json --namespace-id $namespaceId --org "$orgUrl" --query "[0].actions[[email protected] == 'DELETE'].bit | [0]" 

az devops security permission update --id $namespaceId --subject $subject --token $projToken --deny-bit $bit --org "$orgUrl" --merge true

Output is: PS Screenshot

Any idea what I am doing wrong?

Thanks in advance, Jake

Project Administrator is almost the highest permission in project scope, the permissions about that group is not supported to edit... — LoLance

LoLance LoLance · Accepted Answer · 2020-04-22T02:07:17

Any idea what I am doing wrong?

Project Administrator Group owns the highest permissions in Team Project level. So the project permissions (Project Settings=>Permissions) about that group is not editable:

It's by design that Project Administrators will always have the permission to delete team project.

Except the Project Administrators group, other groups's permissions are editable, see:

1.So it you want to add one member to Project Administrator group, he's permission about deleting project can't be removed.

(No matter which way we use, Web page, Azure Devops Rest Api, az devops cli command or what, none of these would work since it's by design)

2.And if you do want to give one member most permissions the Project Administrator should have but except Delete Team Project permission, you can try creating a new group (In project Settings=>Permissions page) and give the group all permissions except Delete Team project permission, something like that:

You also need to do extra job to give the group necessary permissions in Pipeline Security(see pic below), Repos permissions(Project settings=>repos=>repos) ...

Then add the member into this Custom Group instead of default Project Administrators Group.

Group Permission for Azure DevOps via CLI

1 Answers