Mh - I’m running into a very interesting security issue when running a build task.
The task is making API calls to Azure DevOps to retrieve work items via a query.
The task succeeds in calling the /_apis/wit/fields endpoint but fails calling /_apis/wit/wiql/... returning The query ... does not exist, or you do not have permission to read it .
The url opens fine in the browser and returns the result as JSON.
So for some reason the account (Project Collection Build Service) seems not to have permissions to read work item data. I can’t find any security setting that would explain this any pointers?
Agreed. The cost of resolving issues related to fine grained security controls probably outweighs the potential cost of people doing things in AzD they shouldn’t be allowed to in most cases…
Same here, we only go as far as enabling members of the team to edit their own primary/child area and iteration path structure so they can layout their work without help. Mostly to prevent someone from rearranging the wrong teams assets by accident. Any contributor in the team project can edit any of the work items and it has worked out just fine.