No Security Permissions for Retro Boards

[chrisbatchler]

All Project users/teams can view the Retrospectives.

Our team's retros are a safe place to raise issues encountered during sprints and it is not desirable that this feedback could be viewed by other users outside of the Scrum team.

[mpth]

Unfortunately this is technically impossible while the Azure DevOps internal extension data storage is used.

All users in the project collection allways have full read and write access.

https://docs.microsoft.com/en-us/azure/devops/extend/develop/data-storage?view=azure-devops#how-you-can-scope-data

[vvyas2]

I concur if there is a way to add security to retrospectives (ignoring the collection admin), it might be helpful. e.g. How individual repos/pipelines can be denied permissions.

[dieselart]

Unfortunately this is technically impossible while the Azure DevOps internal extension data storage is used.

All users in the project collection allways have full read and write access.

https://docs.microsoft.com/en-us/azure/devops/extend/develop/data-storage?view=azure-devops#how-you-can-scope-data

The main task in this case is to limit the visibility of the "Retrospectives" section to certain groups of users or specified teams.

In our project, the Customer (Stakeholder) is connected to ADO and can see everything, including the retrospective boards, which is highly undesirable, since commercial information can also be discussed in the retrospective.

I guess half of the teams have a similar problem.

There is no direct solution based on showing / hiding the "Retrospectives" section due to the way the extensions are implemented. However, there is a workaround that will allow you to customize access (but not visibility) to a section for specific teams.

To implement it, you need:

1. Add an administration hub for this extension.
2. On the hub page, implement the ability to configure the visibility of the content of the section page in the context of "team <-> project" (many-to-many).
3. Add a retrospectives section accessibility check for a specific team on a specific project in the Retrospectives hub.
4. If access is denied, display a stub with some information for the user. Or just display a blank page.