a·gen·tic a·gil·i·ty

Access denied user needs label permission in TFS

TL;DR; Explains how to resolve “Access denied user needs label permission” errors in TFS by adjusting label permissions at the root folder to allow contributors to create labels.

Published on
2 minute read
Image
https://nkdagility.com/resources/jdpPpvEHzGa
Subscribe

There is always something new to learn with TFS and today I learned something old. I had a user today that was constantly getting the message “Access denied user needs label permission in TFS”.

Although I have configured “one-team-project” for many organisation my current customer is the first that has insisted on draconian security measures. In this case I have removed contributors from the root of the Team Project and each team is granted rights by sub-folder. If each sub-folder represents an application then this makes perfect sense. Until you try to add a label using the Visual Studio IDE.

Access denied user needs label permission in TFS

I spent a little while trying to debug this and finding no issues with my configuration I emailed the champs list. In a timely manner Mr Jesse Houwing replied with a “Well duh Martin… that’s how it has always worked”:

Labels created within the graphical user interface are scoped to the root folder of the team project within which they are created. Labels created from the command line are scoped to the longest common path shared by the items specified in the label command. To specify the fully qualified name of a label, you must concatenate the label name, the ‘@’ symbol, and the label scope, as in Beta@$/TeamProject1 .

- http://msdn.microsoft.com/en-us/library/ms181439(v=vs.80).aspx

Well… poo… That does not sound like a good idea. And then I realised that the TFS team also have to support the lowest common denominator. Those developers that you meet in 2014 who have no idea what a Unit Test is (or think that it is opening the app and clicking some buttons) or what automated builds are. So if they found that they could create Label with the same name but overlapping scopes!

Mind blown…

Access denied user needs label permission in TFS

My solution was to just give contributors access only to labels at the root. This stops that pesky error from occurring in the IDE and really does not pose a security risk.

Subscribe

Connect with Martin Hinshelwood

If you've made it this far, it's worth connecting with our principal consultant and coach, Martin Hinshelwood, for a 30-minute 'ask me anything' call.

Our Happy Clients​

We partner with businesses across diverse industries, including finance, insurance, healthcare, pharmaceuticals, technology, engineering, transportation, hospitality, entertainment, legal, government, and military sectors.​

Big Data for Humans Logo

Big Data for Humans

Slicedbread Logo

Slicedbread

Genus Breeding Ltd Logo

Genus Breeding Ltd

Teleplan Logo

Teleplan

Illumina Logo

Illumina

Qualco Logo

Qualco

ALS Life Sciences Logo

ALS Life Sciences

Healthgrades Logo

Healthgrades

Freadom Logo

Freadom

Kongsberg Maritime Logo

Kongsberg Maritime

Boxit Document Solutions Logo

Boxit Document Solutions

DFDS Logo

DFDS

Microsoft Logo

Microsoft

MacDonald Humfrey (Automation) Ltd. Logo

MacDonald Humfrey (Automation) Ltd.

Emerson Process Management Logo

Emerson Process Management

Slaughter and May Logo

Slaughter and May

Higher Education Statistics Agency Logo

Higher Education Statistics Agency

Bistech Logo

Bistech

Department of Work and Pensions (UK) Logo

Department of Work and Pensions (UK)

Ghana Police Service Logo

Ghana Police Service

Washington Department of Transport Logo

Washington Department of Transport

Washington Department of Enterprise Services Logo

Washington Department of Enterprise Services

New Hampshire Supreme Court Logo

New Hampshire Supreme Court

Royal Air Force Logo

Royal Air Force

Slaughter and May Logo

Slaughter and May

Hubtel Ghana Logo

Hubtel Ghana

Kongsberg Maritime Logo

Kongsberg Maritime

Boeing Logo

Boeing

DFDS Logo

DFDS

Higher Education Statistics Agency Logo

Higher Education Statistics Agency