1

Set approval process to delete any project/repos of Azure DevOps(ADO). I have multiple owners in my private Azure Devops. From the docs it appears that any individual owner/users can go rogue and delete the entire Azure project/repo from existence though i know it can be restore easily in Azure devops within 28 days, But still I'd like to prevent that from happening.

Is there any way to set up Azure Devops user/group permissions such that deleting the repo requires the approval of its owners ? Kindly suggest if I missed the Azure docs if this feature is already there ?

Making myself the sole owner is not a viable solution, as I want to prevent myself (or an unauthorised user of my account) from having this power, too. So need to implement the approval process for this.enter image description here

From below SS you can see it is not expecting any approval while deleting the whole project.

Matt
  • 3,658
  • 3
  • 14
  • 27
saurabh raj
  • 470
  • 4
  • 4
  • Hi friend, is there any update about this ticket? If you have any concern, feel free to share it here. – Walter Feb 18 '21 at 08:51

2 Answers2

0

Unfortunately, you read correctly. There isn't a way to require approval prior to repo deletion.

However, what you can do is create a group of users that you would want to be prevented from deleting repos and update the repo permissions to include an explicit deny for the "Delete Repository" permission:

AzureDevOps - Deny Repo Delete

Jeremy Caney
  • 7,102
  • 69
  • 48
  • 77
Max Morrow
  • 1,206
  • 4
  • 13
  • Just be careful, the deny permission is a strange beast in Azure Devops. The creator of a repo automatically gets a more specific allow deletion permission which will ignore the higher level deny. It's often better or to use the 'not set' option to prevent people from getting an explicit allow. Then only set the allow it for your administrators. – jessehouwing Feb 11 '21 at 21:34
0

I'm afraid there is no such feature to approve delete request. However, you can set the delete permission of users to deny.

  • Project:

If you want to delete a project, you must be a member of the Project Collection Administrators group or have the Delete team project permission set to Allow. enter image description here

You can set this permission to deny if you don’t want other users to delete the project. Members in Project Administrators Group can manage permissions or groups at the project level and their delete project permission is allow by default.

  • Repositories:

You can set the delete repository permission of users to deny. enter image description here In addition, for most groups and almost all permissions, Deny overrides Allow. For members of the Project Collection Administrators or Team Foundation Administrators groups, Deny doesn't trump Allow.

Walter
  • 2,640
  • 1
  • 5
  • 11