Azure DevOps Stage Permissions

Question

I have created a release pipeline with multiple stages. Now I would like on users form the Release Manager group or Project Administrators group to be able to deploy some of these stages.

I have tried to denied "Manage Deployments" to the other groups but it seems as soon as Contributors lose this, no one, not even members of the above groups with the permission set to Allow can deploy the stage anymore. BTW, members of the allowed groups are also members of Contributors.

I tried both just updating the permission and removing Inherited permissions and then removing the permission for those groups and still no go.

Is there any way to remove this permission from Contributors but sill allow members of Contributors + Release Manager + Project Managers to deploy?

Thank you

Answer 1

Is there any way to remove this permission from Contributors but sill allow members of Contributors + Release Manager + Project Managers to deploy?

I could reproduce the scene you mentioned. It seems that the permissions of the Contributors group will override the permissions of the other two groups.

To solve this issue, you could set the Manage Deployments as Not Set instead of Deny. At the same time, you need the disable Inheritance option.

Note: If you set Not Set, people in the contributor group cannot deploy, but if some of them are in other groups with this permission, they will inherit the permissions from other groups