My team is implementing Azure DevOps 2019 server on prem. There is a requirement to give all valid users permission to create shared queries in all projects. Is it possible to set permissions for shared queries at the collection level?
2 Answers
The permissions for shared queries are managed within the queries itself, and whilst the default permissions allow for the built in Project Administrators (and Project Collection Administrators) group to contribute shared queries, you probably don't want to move everyone into one of those groups.
Instead, you would have to go into each team project, go to the queries, and edit the security on the root:
]
You can then grant permissions by group (built in or custom):
(So above, I've changed the built in "contributors" group to allow them to Contribute to queries, which allows them to create new)
Depending on how many team projects you have or create, will depend how manageable the is as a workaround, but it is safer than making everyone an admin
Query is a project-level function, so if you want to access Shared Queries in Peoject B from Peoject A, it may not be possible.
To access Shared Queries, you need to be a member of the team that has permission to access the query, but the team is limited to the project, so shared queries cannot cross projects.
If you really want to share queries between projects, you can make a feature request here: Developer Community
Related