locked
How To Set Permissions for a Team Admin to Delete Test Suites and Test Plans RRS feed

  • Question

  • Please DO NOT reply with a point to Team Services online documentation.  We have reviewed the documentation extensively and the answers we seek are not there.  Plus, the online Team Services documentation and images do not correspond to what we are seeing in the Team Services Web Portal.

    In Team Services, a Project is created and then a Team is created.  The Team (e.g. Bugs\Bugs Team - defined under Settings > Security) has its own permissions... and individual Team Members who are assigned to a VSTS\Security Group (e.g. Contributors and Valid Project Users - defined under Settings > Default team settings) with each VSTS\Security Group having its own permissions.  So which prevails - the Team's (Bugs\Bugs Team) permissions or the members' assigned Group (Contributor and Valid Project Users) permissions ?

    Is there no way to see a list of Team members that explicitly indicates their individual permissions for the project and configure permissions using that list ? We only see a list of Members without any way to see each individual member's permissions.  We can see Members of... however

    All we see under "Members" of is Contributors and Valid Project Users, but the existing members that actually are part of the Project and Team who are on the list is (2) Project Administrators and (1) Team Admin.

    A Team Admin is role-based and inherits permissions from the Contributor Security Group.  So how do we make a Team Admin have the permissions to delete and delete permanently Test Suites and Test Plans ?

    Do we have to edit the Contributor Group permissions ?  -  All we want is for the Test Admin to have all permissions except those permissions that apply specifically to the Project level items in the permissions list.

    Thursday, April 20, 2017 3:20 AM

All replies

  • It will help if you can share the list of documents that you have gone through so that I do not share reparative information.

    Your query has multiple parts:

    1. Which permission prevails - the Team's (Bugs\Bugs Team) permissions or the members' assigned Group (Contributor and Valid Project Users) permissions ?

    Permissions is a hierarchical model. All teams that are created are added to Contributors. So any changes that you make to the contributors will apply to all teams. However, you can override the permissions at the team level by changing the permissions of the team group. Note that what you over ride must not conflict with what is set for contributors.  Example: contributors have permissions to edit work items in all area paths nodes, but for a specific team you can deny that permission for certain area paths. You cannot do the other way round – if contributors is denied permissions to edit work items in all area paths, then a team cannot be allowed permissions to edit work items in a specific path. See https://www.visualstudio.com/en-us/docs/setup-admin/permissions#inheritance

    2. Is there no way to see a list of Team members that explicitly indicates their individual permissions for the project and configure permissions using that list ?

    You can search the alias of an individual user or a team and look at permissions of each of them either at project level or area path level. It’s important to note that they need to check individual users for their specific permissions. It’s possible that a given user belongs to a group that grants them X, but they have a deny either explicitly assigned to them (unlikely) or they belong to another group which denies that permission. Using the why button is key to figuring out what happened to give a user or group a specific permission if something isn’t lining up.

    3. .  So how do we make a Team Admin have the permissions to delete and delete permanently Test Suites and Test Plans ?

    I acknowledge that this is a tricky one. You will need these permissions to delete test suites: “permanently delete work items in this project” + “edit work items under this node” + “manage test plans”. Note that the “permanently delete work items in this project” is at the project level, and not area path level. The other two are at the area path level.

    This was a feature enhancement done to address the customer feedback. Earlier test suites and test plans were left back as orphaned work items when they were deleted from Test hub. We now permanently  delete them, which needs additional permission to permanently delete work items.

    This is documented here: https://www.visualstudio.com/en-us/docs/work/backlogs/remove-delete-work-items#delete-test-artifacts

     

    Thanks
    Manoj

      

    Thursday, April 20, 2017 6:49 PM