You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/organizations/accounts/assign-access-levels-by-group-membership.md
+38-26Lines changed: 38 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,22 +2,24 @@
2
2
title: Add group rule, assign access levels
3
3
titleSuffix: Azure DevOps Services
4
4
ms.custom: engagement-fy23
5
-
description: Learn how to assign access levels with group rules in Microsoft Entra ID and Azure DevOps.
5
+
description: Automate access level management by creating group rules for Microsoft Entra ID and Azure DevOps groups. Streamline user permissions and project access efficiently.
Azure DevOps provides group-based access levels for Microsoft Entra groups and Azure DevOps groups, allowing you to manage permissions efficiently by assigning access levels to entire groups of users. This article explains how to add a group rule to assign an access level to a group of users. Azure DevOps resources are assigned to all members of a group.
18
+
Azure DevOps provides group-based access levels for Microsoft Entra groups and Azure DevOps groups, allowing you to manage permissions efficiently by assigning access levels to entire groups of users. This article explains how to add a group rule to assign an access level to a group of users.
19
19
20
-
Assign a group rule to manage both access levels and project memberships. When a user is assigned to multiple rules or Microsoft Entra groups with different access levels, they receive the highest access level among them. For example, if John is assigned to two Microsoft Entra groups with different group rules—one specifying Stakeholder access and the other Basic access—John receives Basic access.
20
+
Assign a group rule to manage both access levels and project memberships. When a user belongs to multiple rules or Microsoft Entra groups with different access levels, they receive the highest level.
21
+
22
+
**Example:** If a user belongs to two Microsoft Entra groups—one assigning Stakeholder and the other Basic—the user receives Basic access.
21
23
22
24
When a user leaves a Microsoft Entra group, Azure DevOps adjusts their access level according to the group's defined rules. If the group was the user's sole source of access, Azure DevOps automatically removes them from the organization. If the user belongs to other groups, their access level and permissions are reevaluated.
23
25
@@ -30,60 +32,60 @@ When a user leaves a Microsoft Entra group, Azure DevOps adjusts their access le
30
32
|**Permissions**| Member of the [Project Collection Administrators group](../security/look-up-project-collection-administrators.md). Organization owners are automatically members of this group.|
31
33
|**Microsoft Entra**|Member of the Microsoft Entra ID that backs your organization. For more information, see [Access via Microsoft Entra FAQs. Microsoft Entra guests can't search the Microsoft Entra ID in the manner required by Azure DevOps](../accounts/faq-azure-access.yml#no-identities)|
32
34
33
-
## Add group rule
35
+
## Add a group rule
34
36
35
-
1. Sign in to your organization (```https://dev.azure.com/{yourorganization}```).
37
+
1. Sign in to your organization (```https://dev.azure.com/{Your_Organization}```).
3. Select **Permissions**, and then verify that you're a member of the **Project Collection Administrators** group.
42
-
43
-
44
-
45
-
4. Select **Users**, and then select **Group rules**. This view shows you all of your created group rules. Select **Add a group rule**.
41
+
3. Select **Users** > **Group rules** > **Add a group rule**. This view shows you all of your created group rules.
46
42
47
43
48
44
49
45
**Group rules** appear only if you're a member of the **Project Collection Administrators** group.
50
46
51
-
5. Complete the dialog box for the group for which you want to create a rule. Include an access level for the group and any optional project access for the group. Select **Add**.
47
+
4. Complete the dialog box for the group for which you want to create a rule. Include an access level for the group and any optional project access for the group. Select **Add**.
52
48
53
49
54
50
55
-
A notification displays, showing the status and outcome of the rule. If the assignment couldn't be completed, select **View status** to see the details.
51
+
A notification displays, showing the rule's status and outcome. If the assignment fails, select **View status** to see the details.
56
52
57
53
58
54
59
55
> [!IMPORTANT]
60
-
> - Group rules only apply to users without direct assignments and to users added to the group going forward. [Remove direct assignments](#remove-direct-assignments) so the group rules apply to those users.
61
56
> - Users don't appear in **All users** until they attempt to sign in for the first time.
62
57
58
+
## Access level changes
59
+
60
+
- When a user signs in, group rules automatically adjust their access level if the rule assigns a higher level than their current one. For example: A user with Stakeholder access upgrades to Basic if a group rule assigns Basic.
61
+
- If a user already has a higher access level than what the group rule provides, their access stays the same. For example: A user manually assigned Basic access doesn't downgrade when a group rule assigns Stakeholder.
62
+
63
63
## Manage group members
64
64
65
+
Group rules for Microsoft Entra ID groups manage membership in the Azure portal. Group rules for Azure DevOps groups manage membership on the **Group rules** screen.
67
69
68
-
Keep the existing automation for managing user access levels running as-is (for example, PowerShell scripts). The goal is to ensure that the same resources applied by the automation are accurately reflected for those users.
69
-
70
70
2. Add members, and then select **Add**.
71
71
72
72
73
73
74
-
When you assign the same access level to a user, they consume only one access level, regardless of whether the assignment is made directly or through a group.
75
-
76
74
## Verify group rule
77
75
78
-
Verify that the resources are applied to each group and individual user. Select **All users**, highlight a user, and then select **Summary**.
76
+
Verify that the resources apply to each group and individual user:
79
77
80
-
:::image type="content" source="media/assign-access-levels/verify-user-summary.png" alt-text="Screenshot showing verification of user summary for group rule.":::
78
+
1. Select **All users**.
79
+
2. Highlight a user.
80
+
3. Select **Summary**.
81
+
82
+
:::image type="content" source="media/assign-access-levels/verify-user-summary.png" alt-text="Screenshot showing verification of user summary for group rule.":::
81
83
82
84
## Remove direct assignments
83
85
84
-
To manage a user's resources solely through their group memberships, remove any direct assignments. Resources assigned to a user individually remain assigned, regardless of changes to the user's group memberships.
86
+
When a user has a direct assignment and a group rule grants a higher access level, Azure DevOps automatically upgrades the user to the higher level. To manage access levels exclusively through group rules, remove all direct assignments.
85
87
86
-
1. Sign in to your organization (```https://dev.azure.com/{yourorganization}```).
88
+
1. Sign in to your organization (```https://dev.azure.com/{Your_Organization}```).
@@ -101,15 +103,25 @@ To manage a user's resources solely through their group memberships, remove any
101
103
102
104
103
105
104
-
Direct assignments get removed from the users. If a user isn't a member of any groups, then the user isn't affected.
106
+
If a user isn't a member of any groups, then the user isn't affected.
105
107
106
108
### FAQs
107
109
108
110
<aid="more-information"></a>
109
111
110
112
#### Q: How do Visual Studio Subscriptions work with group rules?
111
113
112
-
A: Visual Studio Subscribers are always directly assigned via the [Visual Studio Admin Portal](https://manage.visualstudio.com/) and take precedence in Azure DevOps over access levels assigned directly or via group rules. When you view these users from the Users Hub, the License Source always shows as Direct. The only exception are Visual Studio Professional subscribers who are assigned Basic + Test Plans. Since Basic + Test Plans provides more access in Azure DevOps, it takes precedence over a Visual Studio Professional subscription.
114
+
A: Visual Studio Subscribers are always directly assigned via the [Visual Studio Admin Portal](https://manage.visualstudio.com/) and take precedence in Azure DevOps over access levels assigned directly or via group rules. When you view these users from the Users Hub, the License Source always shows as Direct. The only exception is Visual Studio Professional subscribers who are assigned Basic + Test Plans. Since Basic + Test Plans provides more access in Azure DevOps, it takes precedence over a Visual Studio Professional subscription.
115
+
116
+
#### Q: How do GitHub Enterprise licenses work with group rules?
117
+
118
+
A:
119
+
- Azure DevOps checks whether a user has a GitHub Enterprise license when they sign in. It might take up to 24 hours for their access level to update to GitHub Enterprise. Users with GitHub Enterprise automatically receive the GitHub Enterprise access level, which equals Basic access.
120
+
- If a GitHub Enterprise user needs access to Test Plans, assign the Basic + Test Plans license directly or through a group rule.
121
+
- You can't configure a group rule to assign GitHub Enterprise access because GitHub assigns that license directly through its portal.
122
+
- When a user no longer has a valid GitHub Enterprise license:
123
+
- If your organization configures group rules: The user receives the access specified by their group membership.
124
+
- If your organization doesn't configure group rules: The user receives the organization’s default access level.
> - Azure DevOps applies resources granted by group rules to all members of the configured group. However, access and permissions take effect only after the user signs in to the organization for the first time.
11
12
> - Changes made to **project readers** through group rules don't persist. To adjust project readers, consider alternative methods such as [direct assignment](../change-access-levels.md) or [custom security groups](../add-remove-manage-user-group-security-group.md).
12
-
> - Regularly review the rules listed on the "Group rules" tab of the "Users" page. Changes to Microsoft Entra ID group membership will appear in the next re-evaluation of the group rules, which can be done on-demand, when a group rule is modified, or automatically every 24 hours. Azure DevOps updates Microsoft Entra group membership every hour, but it may take up to 24 hours for Microsoft Entra ID to update [dynamic group membership](/azure/active-directory/enterprise-users/groups-dynamic-membership).
13
+
> - Regularly review the rules listed on the **Group rules** tab of the **Users** page. Changes to Microsoft Entra ID group membership appear during the next group rule re-evaluation, which occurs:
14
+
> - On-demand when you trigger it manually
15
+
> - Automatically when you modify a group rule
16
+
> - Automatically every 24 hours. Azure DevOps updates Microsoft Entra group membership every hour, but Microsoft Entra ID might take up to 24 hours to update [dynamic group membership](/azure/active-directory/enterprise-users/groups-dynamic-membership).
13
17
> - Group rules for licensing currently don't apply to service principals and managed identities. To assign an access level to a service principal or managed identity, assign it directly rather than through group membership. For more information, see [Use service principals & managed identities in Azure DevOps](../../../integrate/get-started/authentication/service-principal-managed-identity.md).
0 commit comments