从 azure devops 管道更新变量组

Question

I am trying to update a variable in a variable group using az pipelines cli from the pipeline, I have created a PAT and passed on to the pipeline its working fine. but I use the default one such as $(System.AccessToken) its able to list the variable from the variable group but unable to update the variable group. Its saying

ERROR: You do not have permissions to perform this operation on the variable group. A variable group Administrator should add you to the Administrator role. ##[error]Script failed with exit code: 1

after some search I found that I need to add Project Collection Build Service ( name ) as the administrator in the variable group and try again. I have added that but still I am getting the same error. any suggestions?

I am using classic pipeline, here is the exported task from the pipeline.

steps
- task: AzureCLI@2
  displayName: 'Azure CLI '
  inputs:
    azureSubscription: 'sc'
    scriptType: pscore
    scriptLocation: inlineScript
    inlineScript: |
     az extension add --name azure-devops
     az pipelines variable-group variable list --group-id id --org "orgname" --project "projectname"
     az pipelines variable-group variable update --group-id id --name apim-service-name --value $(str_tf_module_containername) --org "orgname" --project "projectname"
  env:
    AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)

Answer 1

This works well:

steps
- pwsh: |
     az extension add --name azure-devops
     az pipelines variable-group variable list --group-id id --org "orgname" --project "projectname"
     az pipelines variable-group variable update --group-id id --name apim-service-name --value $(str_tf_module_containername) --org "orgname" --project "projectname"
  env:
    AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)

but you need to give Project Collection Build Service (account) Administrator permission on give variable group: