Manage permissions

Azure DevOps Services | Azure DevOps Server 2022 | Azure DevOps Server 2020

Azure Artifacts enables developers to efficiently manage dependencies by hosting various types of packages in a single feed. With flexible permission settings, you can fine-tune access to your packages, control who can create or administer feeds, and manage how packages are accessed from Azure Pipelines.

Azure Artifacts settings

With Azure Artifacts settings, you can control who can create and administrer feeds.

1. Sign in to your Azure DevOps organization, and navigate to your project.

2. Select Artifacts, then select your feed from the dropdown menu.

3. Select the Azure Artifacts settings icon on the right.

4. Select Who can create feeds and Who can administer feeds, then select Save when you're done.

   

Feed settings

From the Azure Artifacts feed settings, you can manage various aspects of your feed, such as enabling package sharing, configuring retention policies, adding new users or groups, managing view permissions, and setting up or modifying upstream sources. Here's how to add a new user or group to your feed:

1. Sign in to your Azure DevOps organization, then navigate to your project.

2. Select Artifacts, then select your feed from the dropdown menu.

3. Select the gear icon on the right to navigate to your Feed Settings.

4. Select Permissions, then select Add users/groups.

   

5. Add the new user(s) or group(s), and assign the appropriate Role:

   1. Feed Owner: Can delete packages, allow external package versions, edit feed settings, and manage upstream sources, in addition to contributor permissions.
   2. Feed Publisher (Contributor): Can publish, promote, or deprecate packages along with collaborator permissions.
   3. Feed and Upstream Reader (Collaborator): Can save packages from upstream source in addition to reader permissions.
   4. Feed Reader: Can view and download packages from the feed.

6. Select Save when you're done.

Feed roles and permissions

Azure Artifacts provides a flexible permission model to manage access within feeds. Each role comes with specific privileges that determine what actions a user or group can perform. The table below outlines the key permissions associated with each role:

Feed views settings

Feed views in Azure Artifacts enable users to share specific packages while keeping others private. A common use case is sharing a package version that has been tested and validated, while keeping packages still under development restricted.

By default, each feed includes three views: @Local, @Prerelease, and @Release. The latter two are suggested views that can be renamed or deleted as needed. The @Local view is the default and includes all packages published directly to the feed, as well as packages saved from upstream sources.

1. Sign in to your Azure DevOps organization, then navigate to your project.

2. Select Artifacts, then select your feed from the dropdown menu.

3. Select the gear icon to navigate to your Feed Settings.

4. Select Views, select the ellipsis button next to your view, then select Edit to modify its permission.

5. To restrict access to your view, change the visibility setting to specific people.

   Important

   Views inherit permissions from the parent feed. If you set a view's visibility to Specific people without specifying any users or groups, the view's permissions will default back to the permissions of the parent feed.

6. Select Save when you're done. The access permissions column will update to reflect your changes.

   

Pipelines permissions

To access your feed from your pipeline, the corresponding build identity must have the necessary permissions. The project-level build identity is named [Project name] Build Service ([Organization name]), for example FabrikamFiber Build Service (codesharing-demo) while the organization-level build identity is named Project Collection Build Service ([Organization name]), for example Project Collection Build Service (codesharing-demo). Here's how to add the build identity to your feed's permissions:

1. Sign in to your Azure DevOps organization, then navigate to your project.

2. Select Artifacts, then select your feed from the dropdown menu.

3. Select the gear icon to navigate to Feed settings.

4. Select Permissions, then select Add users/groups. Add your build identity and assign it the Feed and Upstream Reader (Collaborator) role. If your pipeline needs to publish packages to the feed, make sure that both the Project Collection Build Service and your project's Build Service identities have the Feed Publisher (Contributor) role.

   

Examples

See the examples below to learn how to authenticate and publish packages to your feed with Azure Pipelines.

Related content

• Monitor Artifacts storage consumption

• Promote packages and manage feed views

• Set up upstream sources