DEV Community

Crypto_Cactuar
Crypto_Cactuar

Posted on

How to restrict work item visibility/access to the team only in Azure DevOps

How do you stop other team members from viewing your work items?
Let's start off by saying, If you have the permissions to create your own Azure DevOps (ADO) project then it's pretty easy. All you have to do is remove that person from your project and your done.
(not recommended) The simplest way to do this is by explicy denying view work item permissions for a user
Go to Project Settings → Team Configuration → Click on Area (near the top)→ Find your Area and click the ellipsis → Click Security → Add the user and then set "view work items in this node" to Deny
From now on that user won't be able to see any work items created in that area.
(recommended) I'm going to show you the proper way to do this. The way you would do it in an enterprise environment.
SENARIO: Let's assume we have a ADO project with 20 users. For sake of simplicity let's say 10 developers and 10 testers and everybody can see everybody's work items.
The way to do this is to use Teams and Area path. Most user's don't know how to use area path and teams properly. but if properly used you can restrict other teams from viewing your work items with ease!
The first thing you want to do is separate out these 20 users into two seperate teams.
Tip: Each Team gets its own kanban board so viewing work items separately becomes a lot easier.
I'm going to create two teams, Team A and Team B and add the users to each team. When you create a team, make sure you tick the little box at the bottom. This will create a new area path for the team.
Tip: Area paths allow you to group work items by team, product, or feature area.
I will also create a test user and add it to Team B. This way I can test if this works by logging in as the test user and checking if I can see/not see the work items.
Now that I have my two teams created, i'm going to go to Team A's kanban board and create a new BPI
Denying Team B from viewing Team A's work items
Next we will explicitly deny Team B from from viewing any work item created by Team A.
Go to Project Settings 
→ Project Configuration 
→ Click Area (at the top) 
→ Find Team A's area and click on the ellipsis (…)
→ Click Security
→ Click the plus sign (+)
→ Add Team B
→ Set "view work items in this node" to Deny
now Team B can not view any work items created by Team A in the area path "Team A".
Let's test this out!!!
I'm going to login as one of the users in Team B and check if I can view the work item that was created by Team A.
… some time goes by …
ok so i've logged in as a user from Team B. I've clicked on Team A's kanban Board and I can't see anything!!!
Next i'm going to click on the Work items tab and see if I can see any work items at all!
and again I can't see anything.
Ok im happy with this! Next I want to undo Team B's permission and see if the work item appears back!
I will log back in as my original Team A member, and set the permission to Allow.
… logs back in and Team A member …
Now if I log back in the the user from Team B, I should be able to see the work items on Team A's kanban board.
… logs back in as Team B member …
and there it is. I can see the BPI.
Lets click on the Work items tab just to see if I can see it there as well.
and there it is!! cream chargers uk
I hope you find this useful.

Top comments (0)