Hi,

Check on the permissions.

Work Item Tracking Area-Level Permissions

Hi Faraz & Guruprasad,

Faraz, have you noticed anything that the "few(particular) of our team users" have in common, with regard to Team Foundation Security?

For example, I gather from your posting you have added them directly; are they also members of security groups that otherwise have Team Foundation permissions?

Any information regarding how you structure your permissions may help in figuring this out.

Thanks,

Kevin McMurry - MSFT

Hi Faraz,

Thanks for your reply. The most likely cause that suggests itself is that these particular uses may also be members of some other TFS group that has deny permission set and that upon background processing that the deny trumps the grant permission. I'll check to see if there may be other known causes and reply back.

Thanks,

Kevin

Hi Faraz,

My pleasure and thank you for your reply. In my checking I have not found any other known causes of this behavior and am following-up in-person with those who have worked most closely on the feature. I'll let you know how this goes.

Meanwhile just in-case it may be helpful: even if all your permissions in TFS are setup as you expect, if anyone (else) added the affected users to a domain security group that indirectly has a deny privilege in TFS, it would account for this behavior.

I'm not suggesting this is the case, but only mention it to callout that it may not be easy to 'be careful'. I've logged a suggestion on that by the way.

Thanks again,

Kevin

Hi Faraz,

Regarding your first point, no, the following scenario is expected behavior and I believe it or similar could explain the problem you are having:

1) user 'mydomain\Bob' has TFS 'Allow' permission to team project [Myproject]\Contributors

2) domain group 'mydomain\RestrictedUsers' has TFS 'Deny' permission in team project [Myproject]\Contributors

3) user 'mydomain\Bob' is a member of domain group 'mydomain\guestprojectcontributors'

4) user 'mydomain\Bob' can read and write work items ok

5) domain group 'mydomain\guestprojectcontributors' is added to domain group 'mydomain\RestrictedUsers'

6) background process takes place following which 'mydomain\Bob' no longer can access work items in 'Myproject'

7) you remove 'mydomain\Bob' from [Myproject]\Contributors, then re-add 'mydomain\Bob' to [Myproject]\Contributors

result: 'mydomain\Bob' can read and write work items for awhile, until background processing completes, at which point he can no longer access work items in the project.

Regarding your second point, we have not released a tool that performs this analysis, however:

- it can be done manually, by tracing through the domain security groups and TFS groups involved to find the 'hidden deny'.

- please also feel free to email me directly and I may be able to help further via direct communication (outside the forum)

Please let me know if this helps!

Thanks,

Kevin