Skip to content

Commit a633195

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #8024 from MicrosoftDocs/users/chcomley/pats-view-perm-service-hooks-438921
PATs/Entra Update service-hooks/view-permission.md
2 parents 749e6cf + 1d2fbc4 commit a633195

File tree

1 file changed

+23
-27
lines changed

1 file changed

+23
-27
lines changed

‎docs/service-hooks/view-permission.md‎

Lines changed: 23 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -9,46 +9,44 @@ ms.custom: cross-service
99
ms.author: rgundogmus
1010
author: rgundogmusm
1111
monikerRange: 'azure-devops'
12-
ms.date: 06/28/2024
12+
ms.date: 06/13/2025
1313
---
1414

1515
# Set View permission for a group in Service Hooks
1616
[!INCLUDE [version-lt-eq-azure-devops](../includes/version-lt-eq-azure-devops.md)]
1717

18-
By default, only Project Administrators have _View_ or _Edit_ permissions. To grant these permissions to other users directly, you can use the [command line tool](../organizations/security/manage-tokens-namespaces.md) or the [Security](/rest/api/azure/devops/security/) REST API.
18+
This article explains how to grant _View_ or _Edit_ permissions for Service Hooks in Azure DevOps. By default, only Project Administrators have these permissions. To assign them to other users or groups, use the [command line tool](../organizations/security/manage-tokens-namespaces.md) or the [Security](/rest/api/azure/devops/security/) REST API.
1919

20-
![Screenshot showing ServiceHooks page without permissions.](./media/permissions/no-permission-service-hooks.png)
21-
22-
The `ServiceHooks` security namespace ID is defined under [List Security Namespaces](../organizations/security/manage-tokens-namespaces.md#list-security-namespaces) as `cb594ebe-87dd-4fc9-ac2c-6a10a4c92046`
20+
The `ServiceHooks` security namespace ID is defined under [List Security Namespaces](../organizations/security/manage-tokens-namespaces.md#list-security-namespaces).
2321

2422
## Prerequisites
2523

2624
| Category | Requirements |
2725
|--------------|-------------|
2826
|**Project access**| [Project member](../organizations/security/add-users-team-project.md). |
29-
|**Permissions**| - Member of the [Project Collection Administrators group](../organizations/security/look-up-project-collection-administrators.md). Organization owners are automatically members of this group.<br>- [Personal access token (PAT)](../organizations/accounts/use-personal-access-tokens-to-authenticate.md) for your Azure DevOps profile. |
27+
|**Permissions**| - Member of the [Project Collection Administrators group](../organizations/security/look-up-project-collection-administrators.md). Organization owners are automatically members of this group.<br>- [Microsoft Entra token](../integrate/get-started/authentication/entra.md) or [Personal access token (PAT)](../organizations/accounts/use-personal-access-tokens-to-authenticate.md) for your Azure DevOps profile. <br>[!INCLUDE [use-microsoft-entra-reduce-pats](../includes/use-microsoft-entra-reduce-pats.md)] |
3028
|**Tools**|[Azure CLI](/cli/azure/install-azure-cli).<br>1. Sign in with `az devops login`.<br>2. You can define your organization as default organization. Otherwise, define `--org "https://dev.azure.com/{organization}"` for each command. ```az devops configure --defaults organization="https://dev.azure.com/{organization}"```<br>3. Check if you can see list of permissions for your organization: ```az devops security permission namespace list --org "https://dev.azure.com/{organization}"```. |
3129

3230
## Read group identity and permission token
3331

3432
1. Find your group identity descriptor.
3533
```
36-
> az devops security group list --project ac515e82-560c-4af8-845b-9f7f968d8e7b --output table
34+
> az devops security group list --project 00000000-0000-0000-0000-000000000000 --output table
3735
3836
Name Descriptor
3937
----------------------------------------------- --------------------------------------------------------------------------------------------------------------------------------------------------
40-
[TEAM FOUNDATION]\EntraServiceHooksRead aadgp.Uy0xLTktMTU1MTM3NDI0NS0xMjA0NDAwOTY5LTI0MDI5ODY0MTMtMjE3OTQwODYxNi0zLTM5NTQxNzM3ODYtMTUyMTA4MTkyNS0yNTQwNTA4MjYzLTMzNDgxNjQxNjg
38+
[TEAM FOUNDATION]\EntraServiceHooksRead Aa1Bb~2Cc3.-Dd4Ee5Ff6Gg7Hh8Ii9_Jj0Kk1Ll2
4139
```
4240
If you want to filter by group name, you can use `findstr` or `grep` command depends on your command prompt.
4341
4442
2. Get permission token.
4543
```
46-
> az devops security permission list --id cb594ebe-87dd-4fc9-ac2c-6a10a4c92046 --subject <Group or user descriptor> --output table
44+
> az devops security permission list --id 00000000-0000-0000-0000-000000000000 --subject <Group or user descriptor> --output table
4745
4846
Token Effective Allow Effective Deny
4947
------------------------------------------------------ ----------------- ----------------
5048
PublisherSecurity 0 0
51-
PublisherSecurity/ac515e82-560c-4af8-845b-9f7f968d8e7b 0 0
49+
PublisherSecurity/00000000-0000-0000-0000-000000000000 0 0
5250
```
5351
5452
## Update read permission for service hooks
@@ -60,34 +58,32 @@ The `ServiceHooks` security namespace ID is defined under [List Security Namespa
6058
- Publish Events
6159
6260
```
63-
> az devops security permission namespace show --id cb594ebe-87dd-4fc9-ac2c-6a10a4c92046
64-
65-
[
61+
> az devops security permission namespace show --id 00000000-0000-0000-0000-000000000000
6662
{
6763
"actions": [
6864
{
6965
"bit": 1,
7066
"displayName": "View Subscriptions",
7167
"name": "ViewSubscriptions",
72-
"namespaceId": "cb594ebe-87dd-4fc9-ac2c-6a10a4c92046"
68+
"namespaceId": "00000000-0000-0000-0000-000000000000"
7369
},
7470
{
7571
"bit": 2,
7672
"displayName": "Edit Subscription",
7773
"name": "EditSubscriptions",
78-
"namespaceId": "cb594ebe-87dd-4fc9-ac2c-6a10a4c92046"
74+
"namespaceId": "00000000-0000-0000-0000-000000000000"
7975
},
8076
{
8177
"bit": 4,
8278
"displayName": "Delete Subscriptions",
8379
"name": "DeleteSubscriptions",
84-
"namespaceId": "cb594ebe-87dd-4fc9-ac2c-6a10a4c92046"
80+
"namespaceId": "00000000-0000-0000-0000-000000000000"
8581
},
8682
{
8783
"bit": 8,
8884
"displayName": "Publish Events",
8985
"name": "PublishEvents",
90-
"namespaceId": "cb594ebe-87dd-4fc9-ac2c-6a10a4c92046"
86+
"namespaceId": "00000000-0000-0000-0000-000000000000"
9187
}
9288
],
9389
"dataspaceCategory": "Default",
@@ -96,7 +92,7 @@ The `ServiceHooks` security namespace ID is defined under [List Security Namespa
9692
"extensionType": null,
9793
"isRemotable": true,
9894
"name": "ServiceHooks",
99-
"namespaceId": "cb594ebe-87dd-4fc9-ac2c-6a10a4c92046",
95+
"namespaceId": "00000000-0000-0000-0000-000000000000",
10096
"readPermission": 1,
10197
"separatorValue": "/",
10298
"structureValue": 1,
@@ -108,15 +104,15 @@ The `ServiceHooks` security namespace ID is defined under [List Security Namespa
108104
109105
2. Set _View_ access for the group. View ServiceHooks Subscriptions equals 1 for `--allow-bit`.
110106
```
111-
> az devops security permission update --namespace-id cb594ebe-87dd-4fc9-ac2c-6a10a4c92046 --subject <Group or user descriptor> --token PublisherSecurity/ac515e82-560c-4af8-845b-9f7f968d8e7b --allow-bit 1
107+
> az devops security permission update --namespace-id 00000000-0000-0000-0000-000000000000 --subject <Group or user descriptor> --token PublisherSecurity/00000000-0000-0000-0000-000000000000 --allow-bit 1
112108
113109
[
114110
{
115111
"acesDictionary": {
116-
"Microsoft.TeamFoundation.Identity;S-1-9-1551374245-1204400969-2402986413-2179408616-3-3954173786-1521081925-2540508263-3348164168": {
112+
"Microsoft.TeamFoundation.Identity;00000000-0000-0000-0000-000000000000": {
117113
"allow": 1,
118114
"deny": 0,
119-
"descriptor": "Microsoft.TeamFoundation.Identity;S-1-9-1551374245-1204400969-2402986413-2179408616-3-3954173786-1521081925-2540508263-3348164168",
115+
"descriptor": "Microsoft.TeamFoundation.Identity;00000000-0000-0000-0000-000000000000",
120116
"extendedInfo": {
121117
"effectiveAllow": 1
122118
},
@@ -132,19 +128,19 @@ The `ServiceHooks` security namespace ID is defined under [List Security Namespa
132128
},
133129
"includeExtendedInfo": true,
134130
"inheritPermissions": true,
135-
"token": "PublisherSecurity/ac515e82-560c-4af8-845b-9f7f968d8e7b"
131+
"token": "PublisherSecurity/00000000-0000-0000-0000-000000000000"
136132
}
137133
]
138134
```
139135
140136
3. Get permission token to see your changes.
141137
```
142-
> az devops security permission list --id cb594ebe-87dd-4fc9-ac2c-6a10a4c92046 --subject <Group or user descriptor> --output table
138+
> az devops security permission list --id 00000000-0000-0000-0000-000000000000 --subject <Group or user descriptor> --output table
143139
144140
Token Effective Allow Effective Deny
145141
------------------------------------------------------ ----------------- ----------------
146142
PublisherSecurity 0 0
147-
PublisherSecurity/ac515e82-560c-4af8-845b-9f7f968d8e7b 1 0
143+
PublisherSecurity/00000000-0000-0000-0000-000000000000 1 0
148144
```
149145
150146
The following example shows that the user can see the service hooks subscriptions.
@@ -156,16 +152,16 @@ The following example shows that the user can see the service hooks subscription
156152
- If you need to reset all Service Hooks permissions of a group or user, you can call `reset-all`.
157153
158154
```
159-
> az devops security permission reset-all --id cb594ebe-87dd-4fc9-ac2c-6a10a4c92046 --subject <Group or user descriptor> --token PublisherSecurity/ac515e82-560c-4af8-845b-9f7f968d8e7b
155+
> az devops security permission reset-all --id 00000000-0000-0000-0000-000000000000 --subject <Group or user descriptor> --token PublisherSecurity/00000000-0000-0000-0000-000000000000
160156
161157
Are you sure you want to reset all explicit permissions for this user/group and token? (y/n): Y
162158
true
163159
164-
> az devops security permission list --id cb594ebe-87dd-4fc9-ac2c-6a10a4c92046 --subject <Group or user descriptor> --output table
160+
> az devops security permission list --id 00000000-0000-0000-0000-000000000000 --subject <Group or user descriptor> --output table
165161
Token Effective Allow Effective Deny
166162
------------------------------------------------------ ----------------- ----------------
167163
PublisherSecurity 0 0
168-
PublisherSecurity/ac515e82-560c-4af8-845b-9f7f968d8e7b 0 0
164+
PublisherSecurity/00000000-0000-0000-0000-000000000000 0 0
169165
```
170166
171167
- The following example shows that the user can't view to service hooks subscriptions after the permission gets reset.

0 commit comments

Comments
 (0)