Having no permission for updating Variable Group via Azure DevOps REST API from running Pipeline

问题

In a nutshell, I am trying to update a Variable Group when executing a PowerShell script from a build Pipeline (increasing a build number, but this part is not so important).

As it suggested in this topic and Azure DevOps docs I use code similar to:

$url = "$($env:SYSTEM_TEAMFOUNDATIONCOLLECTIONURI)$env:SYSTEM_TEAMPROJECTID/_apis/build-release/definitions/$($env:SYSTEM_DEFINITIONID)?api-version=2.0"
Write-Host "URL: $url"
$pipeline = Invoke-RestMethod -Uri $url -Headers @{
    Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"
}
Write-Host "Pipeline = $($pipeline | ConvertTo-Json -Depth 1000)"

Everything works fine in general except one thing. I seem don't have some sort of permission to update this value receiving the following error message:

You do not have permissions to perform this operation on the variable group. A variable group Administrator should add you to the Administrator role.

However:

1. It's a bit weird as $env:SYSTEM_ACCESSTOKEN to me should actually belong to the process (the Pipeline executing process) which is invoked from inside Azure, so it also should have access to Variable Groups. (In any case, I am not aware of what's the Identity of the currently running Pipeline and where it's setup).

2. I can understand that the process is executed on one machine (actually, across different systems, so that's all complicated and doesn't mean the Pipeline executing Identity automatically has the access to Variable Group directly), but I can't find any documentation on how to setup all those access rights. (The articles on the links attached mention nothing about the access rights).

I've tried to add/setup any (possibly related) users/groups to the Group Variable Permissions (Security section of the Variable Group section), but still no luck with the REST API updates.

So, any hints on setting up the permissions for currently executing Identity of build Pipeline?

回答1:

The OAuth Access Token is created with "Project Collection Build Service(xxx)" account, but not your account.

So you just need to add "Project Collection Build Service(xxx)" account as Administrator role for the variable group.

来源：https://stackoverflow.com/questions/52986076/having-no-permission-for-updating-variable-group-via-azure-devops-rest-api-from