Granting Pipeline-Scoped Permission So User1 Can Delete a Test Stage in Pipeline1

Why the Answer Is Correct

The requirement is that User1 can delete the stage final1 in Pipeline1, under least privilege. Azure Pipelines exposes permissions at the collection, project, and pipeline levels, and there is no stage-level grant, so the pipeline level is the narrowest scope that actually exists and it confines User1's rights to Pipeline1 alone. That satisfies least privilege because User1 cannot touch any other pipeline in the project or organization. The vote was 71 for A and 29 for C. The strongest supporting evidence came from people who had actually tried it: Mattt and Emil_Topics each stated plainly that Azure DevOps does not have direct permissions for individual stages, and ahmedMN explained that permissions are managed at the broader levels such as pipeline, project, or organization, naming A as the correct answer.

Why the Other Options Are Wrong

Granting permission at the stage level (C) is the most intuitive reading of least privilege and it is what 29 voters chose, with MrAZ105 arguing that stage is the level where the need actually lies and p2006 citing the set-release-stage-permissions section of the permissions documentation. The decisive counterpoint is that the permissions documentation section p2006 points at concerns setting release stage permissions in a deployment, which is a different mechanism from granting a user the right to edit or delete a stage in a YAML pipeline. Since the stage level is not an available grant for this scenario, the option cannot be correct. Granting permission at the project level (D) is broader than necessary because it would let User1 modify or delete stages in every pipeline in the project, not just final1 in Pipeline1. Granting permission at the organization level (B) is broader still, exposing every project and pipeline in the organization to User1.

Community Comment Notes

The community favored A at 71 votes, and the two most useful comments established the fact that decides the question rather than arguing about least privilege in the abstract. Mattt and Emil_Topics both stated that Azure DevOps has no direct permissions for individual stages, which is an existence proof that option C cannot be implemented. Gooldmember added a useful caveat, asking whether the question targets a YAML pipeline or a release pipeline, and concluded A under the YAML assumption. MrAZ105's argument for C is the strongest case for the minority position, resting on the principle of granting access at exactly the level where it is needed, and p2006 backed it with a documentation link; the reconciliation is that the principle is right but the stage-level grant it assumes does not exist in this scenario.