Restrict Release Pipeline for users

Question

Restrict Release Pipeline for users

shyamal Gajjar 0

Hi,

I want to restrict both build pipeline and release pipeline for users.

I am able to restrict user to create and view build pipeline by following steps

The user had contributor access. but i removed it from there and assigned to this new group and give some permission which default contributor has.
I restrict the group for build pipeline by project-> pipelines->manage security-> deny all permissions and it worked and user cannot event create and view any build pipelines
Same way I tried with project-> pipelines->Releases->All pipelines->Security->Deny all permissions. but user still can see New Pipeline and can access all functions inside it.

Can someone guide me to restrict event this New pipeline button also?

Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-14T16:06:26.35+00:00
Hi @shyamal Gajjar ,

Thanks for reaching out to Microsoft Q&A.

In classic release pipelines, hiding or disabling that button is controlled by the “Create release pipeline” (and related) permissions at the project-level.

Here’s what you can do:

Go to your project in Azure DevOps.

Click Pipelines → Releases.

Switch to the folder (file) view by clicking the folder icon.

Select the All pipelines folder.

Click the ellipsis ( … ) or “More actions” → Security.

In the security dialog, find your restricted group (or add it via the search box).

Explicitly set these permissions to Deny for that group:

Create release pipeline

Edit release pipeline

(Optionally) Delete release pipeline and Manage pipeline stages if you want to lock down every aspect

Close the dialog to save.

Because Deny always overrides Allow, users in that group will no longer be able to create or edit any release definitions. The “New pipeline” button will still appear in the UI (that’s by design) but it will be greyed out or throw an “Access denied” error when clicked.

A few extra tips:

Verify effective permissions: Go to Organization → Users, look up the user’s identity and download the permissions report to be sure no other group is granting Allow.

Access level: Stakeholder users can’t create pipelines at all, but Contributors/Basics need that explicit “Create release pipeline” Allow.

Don’t use a blanket Deny on the Project Contributors group if you have any admins there better to create a custom group and deny just that group.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-15T10:42:08.5766667+00:00

Hi @shyamal Gajjar ,Following up to see if the provided answer was helpful. If this answers your query, do click Accept Answer =>Yes, and upvote it. If you have any further queries do let us know.
shyamal Gajjar 0 Reputation points

2026-05-15T14:19:53.1866667+00:00
I appreciated all for giving quick responses. Let me give detailed info of what I have configured here.

I have creted one user : ******@gmail.com as stake holder and assigned to required project:

I have created one group for such users name: ViewPipeline and assigned the user ******@gmail.com in this group only. this user is not the member of any other group not even contributor.

3. Now, to restrict this user to access build pipeline to create, view, edit, I visited Project settings->pipelines->Manage security.
and then I denied all permissions for pipelines as shown below,
By doing this I restricted group ViewPipeline and it's user : ******@gmail.com for viewing and creating pipelines as show below.

I followed the same process to restrict release pipelines. visited Releases->All pipeline folder-> Security and denied all persmissions to Viewpipeline group as shown below.

Release view as below:
and user : ******@gmail.com an view new pipeline button and also able create release pipeline show below.
Why it is not restricted for release as I have denied all persmissions for the Viewpipeline group. If you guys can guide me to restrict release pipeline also then I will be very thankfull to you...!

@Pravallika KV : do you get a chance to look in to it?
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-15T14:22:13.2833333+00:00

Hi @shyamal Gajjar , thanks for sharing the details, I'll look into it and keep you updated.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-20T17:45:45.4866667+00:00
@shyamal Gajjar ,From what you've described, the restrictions you applied at the Release Pipelines folder level are correct, but in Azure DevOps, release pipeline creation is controlled by project-level permissions as well.

Even if you deny permissions on the “All pipelines” folder, users can still create new release pipelines if they have project-level permissions like:

Create release pipeline

Edit release pipeline

Delete release pipeline

Manage pipeline stages

Check below steps:

Go to Project Settings =>Security.

Select your ViewPipeline group.

Explicitly Deny all the permissions listed above under Release Pipelines.

Optionally, keep your folder-level Deny as an extra layer.

Verify Effective Permissions for your user to ensure no other group is granting Allow.

After this, the “New Pipeline” button may still be visible in the UI (that’s by design), but you will not be able to create or edit any release pipelines.
shyamal Gajjar 0 Reputation points

2026-05-21T08:20:38.7333333+00:00

Hi @Pravallika KV ,

I cannot see Go to Project Settings =>Security.

I can see project Settings-> permissions, but there no options for pipline or release pipline.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-26T09:29:05.8933333+00:00
@shyamal Gajjar Could you please try the below steps:

In your project, go to Pipelines → Releases.

Switch to folder view (click the little file/folder icon).

Click on the All pipelines folder.

Click the ellipsis (…) → Security.

In the Security dialog, find (or add) your restricted group.

Explicitly Deny the following:

Create release pipeline

Edit release pipeline

(optionally) Delete release pipeline

(optionally) Manage pipeline stages

Close the dialog to save.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
shyamal Gajjar 0 Reputation points

2026-05-26T11:18:56.4333333+00:00

@Pravallika KV ,

I have been following the same steps as I already mentioned in the screen-shots. and The user which I wan to restrict is only in one group i.e. ViewPipeline
shyamal Gajjar 0 Reputation points

2026-05-26T14:24:13.0566667+00:00

@Pravallika KV ,

If it is possible then can we have one-to-one call to resolve the issue asap?
Likhitha Sulake 100 Reputation points Microsoft External Staff Moderator

2026-07-23T10:16:46.2866667+00:00

Hi @shyamal Gajjar ,

Could you please let us know if the issue has been resolved on your end? If you're still experiencing the problem, could you share which specific step you're getting stuck on or where the behavior differs from the expected result? If possible, please include any recent screenshots or error messages so we can investigate further.

Looking forward to your update.
Likhitha Sulake 100 Reputation points Microsoft External Staff Moderator

2026-07-27T09:04:23.77+00:00

Hi @shyamal Gajjar ,

Could you let us know if the issue has been resolved? If not, please try the instructions shared in the comments section and update us. If you still need any assistance with this, let us know.
shyamal Gajjar 0 Reputation points

2026-07-27T10:26:23.5433333+00:00

Hi @Likhitha Sulake ,

The issue is still not resolved. I already shared the steps which I followed in previous comments. I think currentlty there is some limitations in azure for the implementation I asked for.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-08-05T20:29:35.07+00:00

Hi @shyamal Gajjar ,

Since the folder-level Deny is already applied correctly and the user belongs to no other group, the restriction is not failing at the release pipeline scope it is being bypassed elsewhere.

Here is what to correct:

1. Confirm which object is actually being created: Classic Release pipelines (Pipelines → Releases) and YAML/build pipelines (Pipelines → New pipeline) are separate objects with separate permission sets. Denies applied under Releases → All pipelines have no effect on YAML pipeline creation. If the user is creating a YAML pipeline, deny Create build pipeline and Edit build pipeline under Project Settings → Pipelines → Manage security instead.

2. Check organization-level group membership: Permissions granted by organization-scoped groups such as Project Collection Administrators or Project Collection Build Administrators are not visible from the project security dialogs and will override what you have set at project level. Go to Organization Settings → Permissions and confirm the user is not a member of any of these groups, directly or through nesting.

3. Verify the identity match: As this is a @gmail.com (MSA) account, confirm the identity signed in during testing is exactly the identity added to the ViewPipeline group. If the account resolves as a different identity, the Deny is applied to a member who never signs in, and the restriction will appear to do nothing.

4. Validate with the effective permissions report: Go to Organization Settings → Users, select the user, then … → View permissions. This shows the source of every Allow the user holds and will confirm which group is granting the create permission.

5. Note on access level. A Stakeholder should not be able to create pipelines regardless of permissions. If this user is genuinely a Stakeholder and is still able to create release pipelines, that points to items 1 or 3 above rather than a permissions misconfiguration.

1 answer

Your answer

Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-14T16:06:26.35+00:00

Hi @shyamal Gajjar ,

Thanks for reaching out to Microsoft Q&A.

In classic release pipelines, hiding or disabling that button is controlled by the “Create release pipeline” (and related) permissions at the project-level.

Here’s what you can do:

Go to your project in Azure DevOps.

Click Pipelines → Releases.

Switch to the folder (file) view by clicking the folder icon.

Select the All pipelines folder.

Click the ellipsis ( … ) or “More actions” → Security.

In the security dialog, find your restricted group (or add it via the search box).

Explicitly set these permissions to Deny for that group:

Create release pipeline

Edit release pipeline

(Optionally) Delete release pipeline and Manage pipeline stages if you want to lock down every aspect

Close the dialog to save.

Because Deny always overrides Allow, users in that group will no longer be able to create or edit any release definitions. The “New pipeline” button will still appear in the UI (that’s by design) but it will be greyed out or throw an “Access denied” error when clicked.

A few extra tips:

Verify effective permissions: Go to Organization → Users, look up the user’s identity and download the permissions report to be sure no other group is granting Allow.

Access level: Stakeholder users can’t create pipelines at all, but Contributors/Basics need that explicit “Create release pipeline” Allow.

Don’t use a blanket Deny on the Project Contributors group if you have any admins there better to create a custom group and deny just that group.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-15T10:42:08.5766667+00:00

Hi @shyamal Gajjar ,Following up to see if the provided answer was helpful. If this answers your query, do click Accept Answer =>Yes, and upvote it. If you have any further queries do let us know.
shyamal Gajjar 0 Reputation points

2026-05-15T14:19:53.1866667+00:00

I appreciated all for giving quick responses. Let me give detailed info of what I have configured here.

I have creted one user : ******@gmail.com as stake holder and assigned to required project:

I have created one group for such users name: ViewPipeline and assigned the user ******@gmail.com in this group only. this user is not the member of any other group not even contributor.

3. Now, to restrict this user to access build pipeline to create, view, edit, I visited Project settings->pipelines->Manage security.
and then I denied all permissions for pipelines as shown below,
By doing this I restricted group ViewPipeline and it's user : ******@gmail.com for viewing and creating pipelines as show below.

I followed the same process to restrict release pipelines. visited Releases->All pipeline folder-> Security and denied all persmissions to Viewpipeline group as shown below.

Release view as below:
and user : ******@gmail.com an view new pipeline button and also able create release pipeline show below.
Why it is not restricted for release as I have denied all persmissions for the Viewpipeline group. If you guys can guide me to restrict release pipeline also then I will be very thankfull to you...!

@Pravallika KV : do you get a chance to look in to it?
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-15T14:22:13.2833333+00:00

Hi @shyamal Gajjar , thanks for sharing the details, I'll look into it and keep you updated.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-20T17:45:45.4866667+00:00

@shyamal Gajjar ,From what you've described, the restrictions you applied at the Release Pipelines folder level are correct, but in Azure DevOps, release pipeline creation is controlled by project-level permissions as well.

Even if you deny permissions on the “All pipelines” folder, users can still create new release pipelines if they have project-level permissions like:

Create release pipeline

Edit release pipeline

Delete release pipeline

Manage pipeline stages

Check below steps:

Go to Project Settings =>Security.

Select your ViewPipeline group.

Explicitly Deny all the permissions listed above under Release Pipelines.

Optionally, keep your folder-level Deny as an extra layer.

Verify Effective Permissions for your user to ensure no other group is granting Allow.

After this, the “New Pipeline” button may still be visible in the UI (that’s by design), but you will not be able to create or edit any release pipelines.
shyamal Gajjar 0 Reputation points

2026-05-21T08:20:38.7333333+00:00

Hi @Pravallika KV ,

I cannot see Go to Project Settings =>Security.

I can see project Settings-> permissions, but there no options for pipline or release pipline.
Pravallika KV 18,850 Reputation points Microsoft External Staff Moderator

2026-05-26T09:29:05.8933333+00:00

@shyamal Gajjar Could you please try the below steps:

In your project, go to Pipelines → Releases.

Switch to folder view (click the little file/folder icon).

Click on the All pipelines folder.

Click the ellipsis (…) → Security.

In the Security dialog, find (or add) your restricted group.

Explicitly Deny the following:

Create release pipeline

Edit release pipeline

(optionally) Delete release pipeline

(optionally) Manage pipeline stages

Close the dialog to save.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
shyamal Gajjar 0 Reputation points

2026-05-26T11:18:56.4333333+00:00

@Pravallika KV ,

I have been following the same steps as I already mentioned in the screen-shots. and The user which I wan to restrict is only in one group i.e. ViewPipeline
shyamal Gajjar 0 Reputation points

2026-05-26T14:24:13.0566667+00:00

@Pravallika KV ,

If it is possible then can we have one-to-one call to resolve the issue asap?
Likhitha Sulake 100 Reputation points Microsoft External Staff Moderator

2026-07-23T10:16:46.2866667+00:00

Hi @shyamal Gajjar ,

Could you please let us know if the issue has been resolved on your end? If you're still experiencing the problem, could you share which specific step you're getting stuck on or where the behavior differs from the expected result? If possible, please include any recent screenshots or error messages so we can investigate further.

Looking forward to your update.
Likhitha Sulake 100 Reputation points Microsoft External Staff Moderator

2026-07-27T09:04:23.77+00:00

Hi @shyamal Gajjar ,

Could you let us know if the issue has been resolved? If not, please try the instructions shared in the comments section and update us. If you still need any assistance with this, let us know.
shyamal Gajjar 0 Reputation points

2026-07-27T10:26:23.5433333+00:00

Hi @Likhitha Sulake ,

The issue is still not resolved. I already shared the steps which I followed in previous comments. I think currentlty there is some limitations in azure for the implementation I asked for.

Answer 1

In Azure DevOps, release pipeline permissions are controlled separately from build pipeline permissions and follow a hierarchy. To restrict users from creating or using release pipelines (including the New pipeline experience), permissions must be denied at the appropriate level and for the correct permissions.

Key points from the permission model:

Release permissions are hierarchical:
- Project-level release pipeline permissions
- Object-level release pipeline permissions
- Stage-level permissions
Project-level settings are inherited by individual release pipelines unless overridden.
Default roles:
- Contributors have all release permissions except Administer release permissions.
- Readers can view pipelines and releases.
- Project/Release Administrators have all permissions.
Relevant release object-level permissions include:
- Manage releases – controls adding/editing approvers and managing releases.
- Edit release pipeline – controls editing release configurations.
- View release pipeline and View releases – control visibility.

To restrict users from creating and using release pipelines, including the New pipeline entry point, apply these steps:

Ensure users are not in any group that grants Contributor-like permissions at project level (for Pipelines). If they must remain in such groups for other reasons, use Deny at the release pipeline scope.
Set project-level release pipeline permissions to Deny for the custom group or user:
1. Go to Pipelines > Releases.
2. Select the file view icon and then All pipelines.
3. Choose More actions > Security.
4. Add the user/group if not present.
5. Set relevant permissions such as Edit release pipeline, Manage releases, Manage deployments, Manage release approvers, and View release pipeline to Deny.
6. Close the dialog to save.
If users still see or can use the New pipeline experience, verify there is no conflicting Allow from another group. In Azure DevOps, Deny overrides Allow, but if the user is in multiple groups, ensure at least one group explicitly has Deny for the release permissions listed above.
If more granular restriction is needed (for specific release pipelines), override object-level permissions:
1. In Pipelines > Releases, select the specific release pipeline.
2. Select More actions > Security.
3. For the user/group, set Allow/Deny/Not set as needed. Setting Deny on Edit release pipeline and Manage releases prevents managing that pipeline.
4. To restore inheritance later, set permissions back to Not set or re-enable Inheritance.

If the goal is to prevent users from even viewing or modifying any release pipelines, combine:

Project-level Deny on View release pipeline and View releases.
Project-level Deny on Edit release pipeline, Manage releases, and related permissions.

This aligns with the documented guidance to restrict access to build and release pipelines by setting Edit release pipeline and View release pipeline to Deny at the object or project level.

References: