You can restrict access to many Team Foundation Server (TFS) tasks by setting the permission state to Deny through a security group. For a comprehensive list of default groups and permissions, see Permission reference for Team Foundation Server.
Q: How do I restrict who can access or modify source code?
A: From the Version Control tab in the TWA administration context, you can set permissions for a group or individual.

For team projects that use Git for version control, you can set the following permissions.

For additional information, see Permission reference for Team Foundation Server.
Q: How do I restrict who can modify build definitions?
A: From the Build hub in TWA, you can set build permissions at the project level for a group or individual.

You can set permissions for the build operations shown in the following image.

Also, you can set permissions by opening the context menu for a build definition.
For additional information, see Permission reference for Team Foundation Server.
Q: How do I restrict access to team members changing a work item?
A: By setting permissions on an area path, you can deny a group or individual the ability to create or edit work items assigned under an area path.
Q: How do I restrict access to people creating specific work item types (WITs)?
A: You can restrict access in one of two ways:
By adding WITs to the Hidden Categories group, you can prevent the majority of project contributors from creating them. You can create a hyperlink to a template that opens the work item form and share that link with those team members who you do want to create them.
By adding a field rule to the workflow for the System.CreatedBy field, you can effectively restrict a group of users from creating a work item of a specific type. As the following example shows, the user who creates the work item must belong to the Allowed Group in order to save the work item.
Copy Code
<TRANSITION from=" " to="New"> <FIELDS> <FIELD refname="System.CreatedBy"> <VALIDUSER for="Allowed Group" not="Disallowed Group" /> </FIELD> </FIELDS> </TRANSITION>
For more information about how to customize WITs, see Modify or add a custom work item type (WIT).
Q: How do I restrict access to changing a work item based on certain conditions or field values?
A: Set a condition field rule, a condition-based field rule or a combination of the two that applies to a group. You can restrict changes from being made to a field by specifying a qualifying rule and making it apply for a specific group. Conditional rules can include CANNOTLOSEVALUE, EMPTY, FROZEN, NOTSAMEAS, READONLY, and REQUIRED elements.
Q: How do I restrict who can modify a shared work item query?
A: Set permissions on a shared query or query folder to restrict who can modify the query or queries within the folder.