tech·nic·al·ly agile

Access denied user needs label permission in TFS

Learn how to resolve the ‘Access denied user needs label permission in TFS’ error and optimize your TFS security settings for smoother project management.

Published on
2 minute read
Image
https://nkdagility.com/resources/jdpPpvEHzGa

There is always something new to learn with TFS and today I learned something old. I had a user today that was constantly getting the message “Access denied user needs label permission in TFS”.

Although I have configured “one-team-project” for many organisation my current customer is the first that has insisted on draconian security measures. In this case I have removed contributors from the root of the Team Project and each team is granted rights by sub-folder. If each sub-folder represents an application then this makes perfect sense. Until you try to add a label using the Visual Studio IDE.

Access denied user needs label permission in TFS

I spent a little while trying to debug this and finding no issues with my configuration I emailed the champs list. In a timely manner Mr Jesse Houwing replied with a “Well duh Martin… that’s how it has always worked”:

Labels created within the graphical user interface are scoped to the root folder of the team project within which they are created. Labels created from the command line are scoped to the longest common path shared by the items specified in the label command. To specify the fully qualified name of a label, you must concatenate the label name, the ‘@’ symbol, and the label scope, as in Beta@$/TeamProject1 .

- http://msdn.microsoft.com/en-us/library/ms181439(v=vs.80).aspx 

Well… poo… That does not sound like a good idea. And then I realised that the TFS team also have to support the lowest common denominator. Those developers that you meet in 2014 who have no idea what a Unit Test is (or think that it is opening the app and clicking some buttons) or what automated builds are. So if they found that they could create Label with the same name but overlapping scopes!

Mind blown…

Access denied user needs label permission in TFS

My solution was to just give contributors access only to labels at the root. This stops that pesky error from occurring in the IDE and really does not pose a security risk.

Troubleshooting
Comments

Related blog posts

Related videos

Connect with Martin Hinshelwood

If you've made it this far, it's worth connecting with our principal consultant and coach, Martin Hinshelwood, for a 30-minute 'ask me anything' call.

Our Happy Clients​

We partner with businesses across diverse industries, including finance, insurance, healthcare, pharmaceuticals, technology, engineering, transportation, hospitality, entertainment, legal, government, and military sectors.​

Lean SA Logo
Graham & Brown Logo
Philips Logo
Epic Games Logo
Illumina Logo
Healthgrades Logo
Lockheed Martin Logo

NIT A/S

Freadom Logo
Microsoft Logo
Boeing Logo
Brandes Investment Partners L.P. Logo
Kongsberg Maritime Logo
Xceptor - Process and Data Automation Logo
Boxit Document Solutions Logo
Slicedbread Logo
Higher Education Statistics Agency Logo
Deliotte Logo
Department of Work and Pensions (UK) Logo
Nottingham County Council Logo
Ghana Police Service Logo
Royal Air Force Logo
Washington Department of Enterprise Services Logo
New Hampshire Supreme Court Logo
Capita Secure Information Solutions Ltd Logo
DFDS Logo
Akaditi Logo
Jack Links Logo
Big Data for Humans Logo
Slicedbread Logo