Azure DevOps：如何仅限制对板的权限？

Question

I want to add a guest account to my Azure Active Directoy and give it access to an Azure DevOps project. Inside the project the guest should only be allowed to create, edit and delete work items. Basically all the features on boards except administrative work. All other features of DevOps should be restricted.

The problem is, that I can't find a way to create a new group which fits my requirements. As soon as a user should be able to create work items he must be member of the default "Contributor" group. But then he can also create environments for example because there is no way to deny permissions regarding environments inside self defined groups.

Does anybody have an idea how to restrict permissions for a user or a group to only the mentioned board related features?

Thanks in advance

Answer 1

Does anybody have an idea how to restrict permissions for a user or a group to only the mentioned board related features?

Indeed, there is no such group which fits your requirements directly.

As workaround, we could create a new group as member of the Contributors group:

we add this new created group as Reader in the Security of Environments:

Then add this new created group to other modules that need to be restricted with same principle.