I’ve written some code which calls az devops security permission list with various parameters to extract the permissions I’m interested in for my various users, so we can report on who has privileged access to specific projects. The gist of this is:

$myId = '[email protected]'
$myOrg = 'https://dev.azure.com/example/'
$myProjectId = 'd1d6f447-cd58-431d-ad22-ee7d6579f6b3'

$projectNamespaceId = '52d39943-cb85-4d7f-8fa8-c6baac873819' # per https://learn.microsoft.com/azure/devops/organizations/security/namespace-reference?view=azure-devops#project-level-namespaces-and-permissions

az devops security permission list --org $myOrg --id $projectNamespaceId --subject $myId | 
ConvertFrom-Json | 
Select-Object token, @{N='EffectiveAllow'; E={
    $dict = $_
    $dict.acesDictionary | 
    Get-Member -type NoteProperty | 
    ForEach-Object {
        $dict.acesDictionary."$($_.Name)".extendedInfo.effectiveAllow
    }
}} | 
Where-Object {$_.token -like "*$myProjectId*"}

This returns:

token                                                                              EffectiveAllow
-----                                                                              --------------
$PROJECT:vstfs:///Classification/TeamProject/d1d6f447-cd58-431d-ad22-ee7d6579f6b3  112

I then compare the Effective Allow permissions with the rights I’m interested in for that namespace; i.e. if $effectiveAllow -band 4 returns 4 it shows that the user has access to delete the project.

This works fine for users who have been granted access at the project level, but for those of us who are assigned rights at a higher level than the project itself (e.g. project collection administrators / organization owner / etc) the value returned for effectiveAllow is always 112, implying that we don’t have access to delete the project (112 -band 4 returns 0).

Is this a bug in my code/approach? Or is there a way to find all users who have this permission, including those assigned permissions from a higher scope than the project itself?