Adding Build Service 'user' to 'Project Collection Build Services' in Azur DevOps

Question

I am trying to allow my build pipeline in Azure DevOps to push changes to a git repo, there is some good documentation from microsoft on how to do this but in my case the build pipeline and the git repo are in two separate projects within the same organisation.

I have tried granting the necessary repo permissions to the 'Project Collection Build Services' group, however I then discovered that this group has no users listed in it.

I have also noticed that in the repo permissions I see listed a user named 'MyProject Build Service (MyOrganisation)', but this user is not listed in the Users for the project (or organisation) and therefore I cannot add it to 'Project Collection Build Services' group. I suppose this User is a system generated user which is used to run the pipeline, is there a way to grant permissions to this user for a repo on another project within the same organisation?

Answer 1

I have resolved the issue, I have found more documentation that explains in more detail user accounts and permissions are set for build pipelines: Manage build service account permissions.

The thing that caught me out was that there are to types of build identities, project scoped (which is the one I was referring in my question above and one that is organisation/collection scoped which has the following name: 'Project Collection Build Service (MyOrganisation)', granting the permission to the latter solved my issue.

Answer 2

Setting up a new project, I had issues with pipeline permissions. I found this post, which led me to the answer, but the accepted answer links to a section further down the page.

Limit job authorization scope to current project for release pipelines

I had to change the Job Authorization Scope under Organization > Project > Settings > Pipeline Settings:

• Limit job authorization scope to current project for non-release pipelines
• Limit job authorization scope to current project for release pipelines

These settings are on by default. Turning them off gives the build service access to shared feeds from other projects in your organization.