1

In an on-premise TFS (Team Foundation Server) 2017 environment, we are unable to find a few groups from Active Directory in the Approvers field of the Release Management system despite the fact that the vast majority of groups and users can be selected.

I initially suspected the issue was due to security, but even after adding the groups as project administrators the system continues to prevent me from finding them in the dropdown.

My next step was to ensure that the groups had a sufficient Access Level, but after granting them the VS Enterprise access the issue persists.

Even though I can find the group in TFS at the Collection Security level, I ruled out an Active Directory Sync issue by running the Active Directory Sync job via the TFS QueueJobNow webservice and waiting for it to complete.

That leaves the following potential issues addressed and verified: TFS Security, TFS Access Level, and Active Directory Sync.

What am I missing here? Is there another level at which I need to grant access for this group?

1

Answering my own question to save some others the trouble.

The issue stemmed from the order of the operations I pursued above. One must first grant security access to the team project (I used Contributor access in my case), then run the Active Directory Sync job via the TFS QueueJobNow webservice using the PowerShell script below (note that the job can take several minutes to complete),

[void][System.Reflection.Assembly]::LoadWithPartialName("Microsoft.TeamFoundation.Client")
$configServer = new-object Microsoft.TeamFoundation.Client.TfsConfigurationServer(new-object System.Uri("http://localhost:8080/tfs"))
$tfsJobService = $configServer.GetService([Microsoft.TeamFoundation.Framework.Client.ITeamFoundationJobService])
$jobs= $tfsJobService.QueryJobs()
$jobID = new-object System.Guid("544DD581-F72A-45A9-8DE0-8CD3A5F29DFE")
foreach ($job in $jobs)
{
    if (($job.JobId -eq $jobID))
    {
        $Identity_SynchronizationJob = $job

        $tfsJobService.QueueJobNow($Identity_SynchronizationJob,$true)
    }
}

and then you should be able to enter the required group into the Approver field of an environment in the Release Management system of TFS.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.