Prevent users from creating new work items in Azure DevOps

1
votes

I've been looking at organisation and project settings but I can't see a setting that would prevent users from creating work items in an Azure DevOps project.

I have a number of users who refuse to follow the guidelines we set out for our projects so I'd like to inconvenience them and the wider project team so that they find it better to follow the guidelines than not - at the moment we've got one-word user stories and/or tasks with estimates of 60-70 hours which isn't reflective of the way that we should be planning.

I'd still want them to be able to edit the stories or tasks and moving statuses, but that initial creation should be off-limits for them (for a time at least). Is there a way to do this??

2
azure-devopsuser-permissionsuser-storiesazure-boards
Something like the aggregator-cli could close the workitem and send an email to the person not following the rules... github.com/tfsaggregator/aggregator-cli - jessehouwing
I like the sound of that - could that be applied to all projects (current and future) without needing to configure it each time? - James
Yes. The aggregator can activate a policy at the organization level. But you'd have to write it (program it) to understand all the types of work item types you need to support. - jessehouwing
Is there any update for this issue? Feel free to let me know if the answer could give you some help. Just a reminder of this. - Leo Liu-MSFT

2 Answers

0
votes

The Azure DevOps Aggregator project allows you to write simple scripts that get triggered when a work item is created or updated. It uses a service hook to trigger when such an event occurs and abstracts most of the API specific stuff away, providing you with an instance of the work item to directly interact with.

You can't block the creation or update from, such a policy, Azure DevOps will inform the aggregator too late in the creation process to do so, but you can revert changes, close the work item etc. There are also a few utility functions to send email.

You need to install the aggregator somewhere, it can be hosted in Azure Functions and we provide a docker container you can spin up anywhere you want. Then link it to Azure DevOps using a PAT token with sufficient permissions and write your first policy.

A few sample rules can be found in the aggregator docs.

store.DeleteWorkItem(self);

should put the work item in the Recycle Bin in Azure DevOps. You can create a code snippet around it that checks the creator of the work item (self.CreatedBy.Id) against a list of known bad identities.

Be mindful that when Azure DevOps creates a new work item the Created and Updated event may fire in rapid succession (this is caused by the mechanism that sets the backlog order on work items), so you may need to find a way to detect what metadata tells you a work item should be deleted. I generally check for a low Revision number (like, < 5) and the last few revisions didn't change any field other than Backlog Priority.

0
votes

I'd still want them to be able to edit the stories or tasks and moving statuses, but that initial creation should be off-limits for them (for a time at least). Is there a way to do this??

I am afraid there is no such out of setting to do this.

That because the current permission settings for the workitem have not yet been subdivided to apply to the current scenario.

There is a setting about this is that:

Project Settings->Team configuration->Area->Security:

enter image description here

Set this value to Deny, it will prevent users from creating new work items. But it also prevent users from modify the workitem.

For your request, you could add your request for this feature on our UserVoice site (https://developercommunity.visualstudio.com/content/idea/post.html?space=21 ), which is our main forum for product suggestions.

enter image description here