You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#customer intent: As an Azure DevOps developer, I want to manage permissions for README files and my team project wiki to ensure secure access for users.
14
+
#customer intent: As an Azure DevOps administrator, I want to manage permissions for README files and my team project wiki to ensure secure access for users.
This article describes how to set and manage permissions for your team project wiki and project README files. By default, all members of the Contributors group have permission to edit wiki pages.
21
+
This article describes how to set and manage permissions for your team project wiki and project README files. Wiki permissions are managed through the underlying Git repository security settings.
22
22
23
-
## Manage permissions for wikis
23
+
By default, all members of the Contributors group have permission to read and edit wiki pages. Project Administrators can modify these permissions to control who can read, edit, or manage wiki content.
24
24
25
-
By default, all project Contributors have "read" and "edit" access to the Git repository for the project wiki. You can manage these permissions and control who can read and edit wiki pages. For more information, see [Get started with permissions, access, and security groups](../../organizations/security/about-permissions.md).
25
+
## Prerequisites
26
26
27
-
1. Sign in to your project (`https://dev.azure.com/<Organization>/<Project>`) in Azure DevOps.
27
+
| Requirement | Description |
28
+
|-------------|-------------|
29
+
|**Permissions**| Project Administrator permissions or Manage permissions permission for the wiki repository |
30
+
|**Project access**| Access to the project where the wiki is located |
31
+
32
+
## How wiki permissions work
33
+
34
+
Wiki permissions are controlled through the underlying Git repository that stores the wiki content. There are two types of wikis in Azure DevOps:
35
+
36
+
-**Project wiki (provisioned wiki)**: Stored in a dedicated Git repository (typically named `<ProjectName>.wiki`)
37
+
-**Code wiki (published wiki)**: Based on files in an existing Git repository
38
+
39
+
Each type uses the same Git repository permission model but might have different repository locations.
40
+
41
+
## Manage permissions for project wikis
42
+
43
+
Project wikis (provisioned wikis) are stored in a dedicated Git repository. You can manage permissions for these wikis through the repository security settings.
44
+
45
+
### View and modify wiki permissions
46
+
47
+
1. Sign in to your organization (`https://dev.azure.com/{organization}`) and go to your project.
28
48
29
49
2. Select **Project settings**.
30
50
31
51
3. Under **Repos**, select **Repositories**.
32
52
33
-
4. Select the wiki repository, typically named `<ProjectName>.wiki`.
53
+
4. Select the wiki repository. For a project wiki, it's typically named `{ProjectName}.wiki`.
54
+
55
+
5. Select the **Security** tab.
56
+
57
+
6. Review the current permissions for users and groups. The permissions list shows:
58
+
-**Users and groups**: Individual users, Azure DevOps groups, and Microsoft Entra ID groups
59
+
-**Permission levels**: Explicit permissions like Allow, Deny, or inherited permissions
60
+
-**Permission types**: Read, Contribute, Force push, Manage permissions, etc.
61
+
62
+
### Key repository permissions for wikis
63
+
64
+
The following repository permissions control wiki access:
65
+
66
+
| Permission | Description | Wiki access |
67
+
|------------|-------------|-------------|
68
+
|**Read**| View repository content | View wiki pages and history |
69
+
|**Contribute**| Read, create, and modify content | Create and edit wiki pages |
70
+
|**Force push**| Rewrite repository history | Force push wiki changes (advanced) |
71
+
|**Manage permissions**| Change repository security | Modify who can access the wiki |
72
+
|**Create branch**| Create new branches | Create wiki branches (advanced) |
73
+
74
+
> [!TIP]
75
+
> For most wiki scenarios, you only need to manage **Read** and **Contribute** permissions. Users with **Contribute** permission can create, edit, and delete wiki pages.
76
+
77
+
## Grant wiki access to users and groups
78
+
79
+
### Add a user or group to wiki permissions
80
+
81
+
1. In the wiki repository **Security** tab, select **Add** (the plus icon) in the users/groups section.
82
+
83
+
2. Search for and select:
84
+
-**Individual users** by email address or display name
85
+
-**Azure DevOps groups** (for example, Contributors, Readers)
86
+
-**Microsoft Entra ID groups** if your organization is connected to Microsoft Entra ID
87
+
88
+
3. After adding the user or group, set their permissions:
89
+
- Set **Read** to **Allow** for view-only access
90
+
- Set **Contribute** to **Allow** for edit access
91
+
- Set permissions to **Deny** to explicitly block access
92
+
93
+
4. Select **Save changes**.
94
+
95
+
### Modify existing permissions
96
+
97
+
1. In the **Security** tab, find the user or group you want to modify.
98
+
99
+
2. Select the permission level (Allow, Deny, or Not set) to change it:
100
+
-**Allow**: Grants the permission explicitly
101
+
-**Deny**: Blocks the permission explicitly (overrides inherited permissions)
102
+
-**Not set**: Uses inherited permissions from parent groups
34
103
35
-
5. Select the **Security** tab to manage permissions for the wiki repository.
104
+
3. Changes are saved automatically.
36
105
37
-
The Security tab displays a list of users and groups with their current permissions. You can modify permissions for existing users/groups.
106
+
### Remove user or group access
38
107
39
-
For definitions of each repository permission, see [Git repository (object-level) permissions](../../organizations/security/permissions.md#git-repository-object-level).
108
+
1. In the **Security** tab, find the user or group you want to remove.
109
+
110
+
2. Select the user or group, then select **Remove** (trash icon).
111
+
112
+
3. Confirm the removal when prompted.
40
113
41
114
> [!NOTE]
42
-
> If you don't have access to create a wiki page, you can request access from a project Administrator. They can grant you adequate permission on the underlying Git repository for the wiki.
115
+
> Removing a user from repository permissions doesn't remove them from the project. It only removes their explicit permissions for this specific wiki repository.
43
116
44
-
## Grant Edit permissions to an individual or group
117
+
## Manage permissions for code wikis (published wikis)
45
118
46
-
To grant *Edit* permissions to an individual or group, complete the following steps:
119
+
Code wikis are based on files in an existing Git repository. Permissions for code wikis are managed through the source repository settings.
47
120
48
-
1. Sign in to your project (`https://dev.azure.com/<Organization>/<Project>`) in Azure DevOps.
121
+
### Set permissions for code wikis
49
122
50
-
2. Select **Project settings**.
123
+
1. Go to **Repos** > **Files** in your project.
51
124
52
-
3. Under **Repos**, select **Repositories**.
125
+
2. Select the repository that contains your published wiki content.
53
126
54
-
4. Select the wiki repository, typically named `<ProjectName>.wiki`.
127
+
3. Select **Settings** > **Security** tab.
55
128
56
-
5. Select the **Security** tab.
129
+
4. Manage permissions using the same process as project wikis, focusing on:
130
+
-**Read**: View wiki content
131
+
-**Contribute**: Edit wiki files
132
+
133
+
## Common permission scenarios
134
+
135
+
### Scenario 1: Read-only wiki access
136
+
137
+
To give a user view-only access to the wiki:
138
+
139
+
1. Add the user to the wiki repository security.
140
+
2. Set **Read** to **Allow**.
141
+
3. Ensure **Contribute** is **Not set** or **Deny**.
142
+
143
+
### Scenario 2: Wiki editors
144
+
145
+
To give a user edit access to the wiki:
146
+
147
+
1. Add the user to the wiki repository security.
148
+
2. Set **Read** to **Allow**.
149
+
3. Set **Contribute** to **Allow**.
57
150
58
-
6. In the security permissions list, find the user or group you want to modify, or select a group like **Contributors** to modify permissions for all members of that group.
151
+
### Scenario 3: Wiki administrators
59
152
60
-
7.To add a new user, modify permissions for existing groups that the user is already a member of.
153
+
To give a user full control over the wiki:
61
154
62
-
> [!NOTE]
63
-
> The exact method for adding users and groups might vary. If there isn't an option to add users directly in the repository security settings, you might need to add users to existing project groups, like Contributors, through **Project settings** > **General** >**Teams** or **Project settings** > **Permissions**.
155
+
1. Add the user to the wiki repository security.
156
+
2. Set **Read**, **Contribute**, and**Manage permissions** to **Allow**.
64
157
65
-
8. To grant *Edit* permissions, locate the **Contribute** permission and set it to **Allow**.
158
+
### Scenario 4: Restrict wiki access
66
159
67
-
9. The changes save automatically.
160
+
To prevent a user from accessing the wiki:
68
161
69
-
### Other considerations
162
+
1. Find the user in the wiki repository security.
163
+
2. Set **Read** to **Deny**.
164
+
165
+
The user's access is blocked even if they have permissions through group membership.
70
166
71
-
When you assign permissions to project users, review the following considerations:
167
+
## Best practices for wiki permissions
72
168
73
-
- Ensure the user or group has the necessary access level to the Azure DevOps project.
169
+
### Security recommendations
74
170
75
-
- Review and adjust other permissions as needed to maintain security and proper access control, such as *Read*, *Delete*, and *Manage*.
171
+
-**Use groups instead of individual permissions**: Add users to appropriate Azure DevOps groups (Contributors, Readers) rather than granting individual permissions.
172
+
-**Follow principle of least privilege**: Grant only the minimum permissions needed for users to complete their work.
173
+
-**Regular permission reviews**: Periodically review who has access to your wikis and remove unnecessary permissions.
174
+
-**Use Microsoft Entra ID groups**: If your organization uses Microsoft Entra ID, use Microsoft Entra ID groups for easier user management.
76
175
77
-
##Stakeholder wiki access
176
+
### Permission inheritance
78
177
79
-
Users with project Stakeholder access have permissions set for *private* and *public* projects.
178
+
- Users inherit permissions from groups they belong to.
- Project-level permissions don't automatically grant repository-level permissions.
182
+
183
+
### Troubleshooting permissions
184
+
185
+
**Problem**: User can't edit wiki pages
186
+
**Solution**:
187
+
1. Verify the user has **Contribute** permission on the wiki repository
188
+
2. Check if there are any **Deny** permissions blocking access
189
+
3. Ensure the user has at least **Basic** access level in the project
190
+
191
+
**Problem**: User can't see the wiki
192
+
**Solution**:
193
+
1. Verify the user has **Read** permission on the wiki repository
194
+
2. Check if the wiki exists and is properly configured
195
+
3. Ensure the user has project access
196
+
197
+
**Problem**: Changes to permissions don't take effect
198
+
**Solution**:
199
+
1. Wait a few minutes for permissions to propagate
200
+
2. Ask the user to refresh their browser or sign out and back in
201
+
3. Verify permissions were saved correctly
202
+
203
+
## Stakeholder access and wikis
204
+
205
+
Users with [Stakeholder access](../../organizations/security/get-started-stakeholder.md) have different wiki permissions depending on project visibility.
80
206
81
207
### Private projects
82
208
83
-
Users with [Stakeholder access](../../organizations/security/get-started-stakeholder.md) in a private project can read [**provisioned**](provisioned-vs-published-wiki.md) wiki pages and view revisions, but they can't edit them. For example, Stakeholders can't create, edit, reorder, or revert changes to project wiki pages. These permissions can't be changed.
209
+
**Project wikis (provisioned)**:
210
+
-**Read access**: Stakeholders can read wiki pages and view revisions
211
+
-**Edit access**: Stakeholders can't create, edit, reorder, or revert wiki pages
212
+
-**Permissions**: These limitations can't be changed through repository permissions
84
213
85
-
Stakeholders have no access to read or edit [**published code**](provisioned-vs-published-wiki.md) wiki pages in private projects. For more information, see the [Stakeholder access quick reference for project and code wikis](../../organizations/security/stakeholder-access.md#public-versus-private-feature-access).
214
+
**Code wikis (published)**:
215
+
-**No access**: Stakeholders can't read or edit published code wikis in private projects
86
216
87
217
### Public projects
88
218
89
-
Stakeholders have full access to wikis in public projects.
219
+
Stakeholders have full read and write access to all wiki types in public projects.
90
220
91
-
For more information about Stakeholder access, see [About access levels, Stakeholder access, Public versus private feature access](../../organizations/security/stakeholder-access.md#public-versus-private-feature-access).
221
+
For more information, see [Stakeholder access quick reference](../../organizations/security/stakeholder-access.md#public-versus-private-feature-access).
92
222
93
-
> [!NOTE]
94
-
> You can set permissions for the entire wiki, but not for individual pages.
223
+
> [!IMPORTANT]
224
+
> Wiki permissions apply to the entire wiki repository. You can't set permissions for individual wiki pages.
225
+
226
+
## README file permissions
227
+
228
+
README files in repositories follow the same permission model as the repository they're contained in:
229
+
230
+
1. Go to **Repos** > **Files**.
231
+
2. Select the repository containing the README.
232
+
3. Select **Settings** > **Security**.
233
+
4. Manage permissions using the repository security settings.
234
+
235
+
Users need **Read** permission to view README files and **Contribute** permission to edit them.
95
236
96
237
## Related content
97
238
239
+
-[Get started with permissions, access, and security groups](../../organizations/security/about-permissions.md)
0 commit comments