Azure DevOps (ADO), as a proprietary Microsoft tool, has become like a one stop for all things related to the software development lifecycle. It holds your code repos, and runs your deployment pipelines, has tests and wikis. With all of this information in one place, good security and access restrictions are necessary, in order to ensure that different professionals can easily integrate and work on a project.

It could be quite cumbersome to assign a role to a project for a new team member. It has to be done on a few levels, and understanding of the access levels in ADO is needed, hence this guide aims to simplify this process.

Adding new users

First of all, the user needs to be added (imported) to the organization, which is done by a member of the Project Collection Administrators group.

The administrator would go into the Organization Setttings, then choose Users, and then select the ‘ Add users ’ button.

From here, the user is given an access level (see more on them below) and can also be added an existing project and an Azure DevOps group. The choices for Azure DevOps groups given at this menu are:

If when you add the user to the Organization, a project is ommited, the user can be added later on to a project, by selecting the Permissions tab in Proejct Settings and then adding the user to one of the Groups. (default or created) Please note that the groups differ slightly from the ones in the Organization Settings menu, and some are even renamed. (Project Contributors is called Contributors)

Access in Azure DevOps

Access in Azure DevOps is controlled with a 2-sided system: Access levels and Azure DevOps Groups.

Additionally, it’s good to know that if you connect your organization with Microsoft Entra Id, you can directly use Entra groups in ADO.

This is done through the Permissions menu in the Organization Settings, where you select New Group, and can add as Members directly the Entra groups.

Access Levels

The following levels are available to be set to users in Azure Devops:

1. Stakeholder

This is the beginner access level that can be assigned to unlimited number of users for free. They have free, but limited access to features and functions. This access is great for most basic operations: add and modify work items, manage build and release pipelines, and view dashboards.

2. Basic

This Basic access level gives users access to most features in ADO, except testing for example. It is useful to have for regular developers or data engineers working on the solution. It gives access to repos for code contributions, Azure Boards for tasks and work items, and pipelines.

3. Basic + Test Plans

Same as Basic access level, but with added Test features. Great for testers on the project, looking to have a view of the repos and the tests.

4. Visual Studio Subscriber

The Visual Studio Subscriber is assigned to users who hae a Visual Studio subscription: either Visual Studio Enterpsie, Visual Studio Professional or MSDN Platform. This is the top level in ADO, and is great for tech leads, architects or DevOps engineers.

Manage users

From the organizational level, you can additionally manage the users directly by going to Users in the Settings menuand then selecting the three dots (…) at the end of the user name, which would give you the context menu with the following options:

From the Project level, you would have to select the Permission blade in Settings, and then either edit one of the Groups, or select an user, and then edit which Groups he is a Member of. This way, he gets the necessary permissions to use certain features of ADO, as discussed above.