Skip to main content

Security and Permissions

1 - Security model​

2 - Security groups​

2.1 Default groups (Project)​

GroupDescription
Project AdministratorsFull project admin
Build AdministratorsPipeline management
ContributorsCommit, PR, work items
ReadersRead-only
Project Valid UsersBasic access

2.2 Organization groups​

GroupDescription
Project Collection AdministratorsSuper admin
Project Collection Build AdministratorsOrg build admin
Project Collection Valid UsersOrganization access

2.3 Create a custom group​

# Via CLI
az devops security group create \
    --name "DevOps Engineers" \
    --description "DevOps team members" \
    --project MonProjet

3 - Permissions​

3.1 Permission levels​

LevelDescription
AllowPermission granted
DenyPermission denied (takes priority)
Not setInherits from the parent

3.2 Repos permissions​

PermissionDescription
ReadRead the code
ContributePush to allowed branches
Create branchCreate branches
Force pushForce push (not recommended)
Manage permissionsManage permissions
Bypass policiesBypass branch policies

3.3 Pipelines permissions​

PermissionDescription
ViewView pipelines
Edit build pipelineEdit builds
Queue buildsStart builds
Delete buildsDelete builds
Stop buildsStop builds
Manage build resourcesManage agents

4 - Service Connections​

4.1 Connection types​

TypeUsage
Azure Resource ManagerDeploy to Azure
Docker RegistryPush/pull images
KubernetesDeploy to K8s
GitHubAccess GitHub repos
SSHSSH connection
GenericCustom service

4.2 Create an Azure Service Connection​

# Via CLI
az devops service-endpoint azurerm create \
    --name "Azure-Production" \
    --azure-rm-subscription-id "subscription-id" \
    --azure-rm-subscription-name "My Subscription" \
    --azure-rm-tenant-id "tenant-id" \
    --azure-rm-service-principal-id "sp-id" \
    --azure-rm-service-principal-key "sp-key"

4.3 Secure the Service Connections​

  1. Pipeline permissions: Limit to certain pipelines
  2. Approvals: Require approval before use
  3. Branch control: Limit to protected branches

5 - Variable Groups and Secrets​

5.1 Create a Variable Group​

# Via CLI
az pipelines variable-group create \
    --name "Production-Secrets" \
    --variables API_URL=https://api.prod.com \
    --authorize true

5.2 Secret variables​

# Ajouter une variable secrète
az pipelines variable-group variable create \
    --group-id 123 \
    --name "API_KEY" \
    --value "secret-value" \
    --secret true

5.3 Azure Key Vault Integration​

variables:
  - group: 'my-variable-group'
  - group: 'keyvault-secrets'  # Linked to Key Vault

# Dans le pipeline YAML
steps:
  - task: AzureKeyVault@2
    inputs:
      azureSubscription: 'Azure-Connection'
      KeyVaultName: 'my-keyvault'
      SecretsFilter: '*'
      RunAsPreJob: true

6 - Organization policies​

6.1 Available policies​

PolicyDescription
Third-party app accessControl OAuth apps
SSH authenticationEnable/disable SSH
Alternate credentialsEnable Git credentials
External guest accessInvite external users

6.2 Audit Logs​

Azure DevOps records all actions:

# Voir les logs d'audit
az devops audit query \
    --organization https://dev.azure.com/MonOrg \
    --start-time 2024-01-01T00:00:00Z \
    --end-time 2024-01-31T23:59:59Z

Audited events:

  • Permission changes
  • Resource creation/deletion
  • Pipeline changes
  • Access to secrets

7 - Security best practices​

7.1 Checklist​

  • Use groups rather than individual permissions
  • Apply the principle of least privilege
  • Protect the main branches
  • Secure the Service Connections
  • Store secrets in Key Vault
  • Enable audit logging
  • Review permissions regularly
  • Use Service Principals with rotation
# Pour la branche main
Policies:
  - Require pull request: true
  - Minimum reviewers: 2
  - Linked work items: true
  - Comment resolution: true
  - Build validation: required
  - Limit merge types: Squash only

7.3 Pipeline Security​

# Limiter les permissions du pipeline
jobs:
  - job: Build
    pool:
      vmImage: 'ubuntu-latest'
    # Ne pas autoriser les scripts à accéder aux secrets
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

8 - Compliance and governance​

  • Disable classic pipelines
  • Require YAML for all pipelines
  • Limit parallel jobs
  • Configure retention policies

8.2 Environment protection​

# Environment avec approvals
- stage: DeployProd
  jobs:
    - deployment: Deploy
      environment: 'Production'  # Requiert approbation
      strategy:
        runOnce:
          deploy:
            steps:
              - script: echo Deploying

Summary​

In this chapter, we learned:

  • The Azure DevOps security model
  • Groups and permissions
  • Service Connections and how to secure them
  • Variable Groups and secrets
  • Organization policies
  • Security best practices

Next step​

In the next chapter, we will look at the overall Best practices.

→ Next chapter: Best practices

← Back to the table of contents