Azure-devops-docs: What is the difference between the Administrator, User, and Reader roles?

[Slooz]

I think I understand the difference between the Administrator and Reader roles, but how does the User role differ from the other roles?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 77d95db6-9983-7346-d0eb-4b7443e4e252
• Version Independent ID: 0a22cccc-318d-592f-d1ab-09ec01d88087
• Content: Environment - Azure Pipelines
• Content Source: docs/pipelines/process/environments.md
• Product: devops
• Technology: devops-cicd
• GitHub Login: @RoopeshNair
• Microsoft Alias: ronai

[msebolt]

@Slooz Thank you for the question.

Roles are often ambiguous and can be defined differently depending on the task.

Please refer to deployment pool security roles and include additional questions below.

[Slooz]

So if somebody manually triggers a deployment job, will the job only succeed if that person is a User or Administrator? Will the deployment job fail if the person that manually triggered it was a Reader?

[Slooz]

Also, I opened this Issue specifically against the Environments documentation. I'm specifically asking about the Roles that you assign in the Security page for Environments. I don't think this is ambiguous. As far as I know, Environments are only used for one task, which is for deployment jobs.

This is different from the deployment pool security roles. There should be a separate section for environment security roles.

I'm specifically talking about the roles on this page:
https://dev.azure.com/{organization}/{project}/_environments/{environment}/security

[RoopeshNair]

• Administrator can administer permissions, manage, view and use an environment
• User can view the environment and use it in a pipeline.
• Reader can only view the environment.

The roles have no bearing on whether who is triggering the pipeline but during authoring whether they can consume the environment or not.

[Slooz]

Thank you.

So to make sure I understand correctly, the difference between a User and a Reader is that a User can create a pipeline that uses the environment, while a Reader cannot create a pipeline that uses the environment?

[RoopeshNair]

User can create the pipeline that references an environment. It will prompt for authorization so that the pipeline can deploy to the environment. Once authorized, the reader can trigger the pipeline as well.