Azure and Azure DevOps permissions

[gitbpotalan]

Hello,
Due to the addition of these new services, I was able to retrieve some permissions using the provided json for each components :
https://raw.githubusercontent.com/microsoft/Microsoft365DSC/Dev/Modules/Microsoft365DSC/DSCResources/MSFT_ADOSecurityPolicy/settings.json

However to me, that seems unclear or not completely filled yet about : which Azure/Entra roles are required, most permissions are displayed as delegated.
I'm trying to analyze prerequisites to run these exports and imports, is there any more information ?

[FabienTschanz]

There are no Azure or Entra roles required to access Azure DevOps. It has a dedicated permission model based entirely in the service. You can check out https://microsoft365dsc.com/user-guide/get-started/authentication-and-permissions/#azure-devops on how to get it to work. On my app registration, no additional permissions or roles were assigned.

[gitbpotalan]

Hello Fabien,
Yes I've seen this article, but currently for Azure there's almost nothing, besides Billing Reader.

[gitbpotalan]

Both for Export and Import.

[FabienTschanz]

@gitbpotalan Sorry about that, totally skipped the Azure part. You're right, for the Azure stuff you most of the time need some permission on the subscription level, but I'm not sure here as well. Will take a look at it to be sure and update the article on the website. Thanks!