Update Build Variable task in Release Pipeline, probably a security issue.

[dowdian]

I have added a task to my release pipeline to update a build pipeline variable called CustomVersion from "00" to "99". I have set the permissions for my [ProjectName] Build Service ([Name]) account to allow both "Edit release pipeline" under the Release Pipelines tab and separately "Edit build pipeline" under the Build Pipelines tab. There is no option for "Edit build definition" available to me anywhere that I can find. I have tried running the job from a private agent, windows-latest agent, and ubuntu-latest agent. The logs of the task always look more or less like the following:

2022-09-02T11:09:25.6895206Z �[33;1mVERBOSE: Current value of the pipeline variable [CustomVersion] is [00]�[0m
2022-09-02T11:09:25.6903339Z 
2022-09-02T11:09:25.6904444Z �[33;1mVERBOSE: Manually updating variable�[0m
2022-09-02T11:09:25.6904727Z 
2022-09-02T11:09:25.6905306Z �[33;1mVERBOSE: Setting pipeline variable [CustomVersion] to value [99]�[0m
2022-09-02T11:09:25.6905613Z 
2022-09-02T11:09:25.6906156Z �[33;1mVERBOSE: Using SystemVssConnection personal access token�[0m
2022-09-02T11:09:25.6906463Z 
2022-09-02T11:09:25.6907087Z �[33;1mVERBOSE: Updating Build Definition 10 for https://dev.azure.com/MyCompany//My Big Project�[0m
2022-09-02T11:09:25.6907631Z 
2022-09-02T11:09:25.6939373Z ##[error]�[91mUpdate-Build: �[0m/home/vsts/work/_tasks/BuildVariableTask_115030de-9ced-4d2f-ad01-8c42d20d0327/2.9.12/BuildVariableTask.ps1:315
�[96mLine |
�[96m 315 | �[0m         �[96mUpdate-Build -tfsuri $collectionUrl -teamproject $teamproject�[0m …
�[96m     | �[91m         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
�[91m�[96m     | �[91mCannot update the build, probably a rights issues see
�[96m     | �[91mhttps://github.com/rfennell/AzurePipelines/wiki/BuildTasks-Task (foot of page) to see notes on granting rights to the build user to edit build defintions
�[0m

2022-09-02T11:09:25.6949398Z ##[debug]Processed: ##vso[task.issue type=error;]�[91mUpdate-Build: �[0m/home/vsts/work/_tasks/BuildVariableTask_115030de-9ced-4d2f-ad01-8c42d20d0327/2.9.12/BuildVariableTask.ps1:315%0A�[96mLine |%0A�[96m 315 | �[0m         �[96mUpdate-Build -tfsuri $collectionUrl -teamproject $teamproject�[0m …%0A�[96m     | �[91m         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~%0A�[91m�[96m     | �[91mCannot update the build, probably a rights issues see%0A�[96m     | �[91mhttps://github.com/rfennell/AzurePipelines/wiki/BuildTasks-Task (foot of page) to see notes on granting rights to the build user to edit build defintions%0A�[0m%0A
2022-09-02T11:09:25.6951855Z ##[debug]task result: Failed
2022-09-02T11:09:25.6954493Z ##[error]�[91mUpdate-Build: �[0m/home/vsts/work/_tasks/BuildVariableTask_115030de-9ced-4d2f-ad01-8c42d20d0327/2.9.12/BuildVariableTask.ps1:315
�[96mLine |
�[96m 315 | �[0m         �[96mUpdate-Build -tfsuri $collectionUrl -teamproject $teamproject�[0m …
�[96m     | �[91m         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
�[91m�[96m     | �[91mCannot update the build, probably a rights issues see
�[96m     | �[91mhttps://github.com/rfennell/AzurePipelines/wiki/BuildTasks-Task (foot of page) to see notes on granting rights to the build user to edit build defintions
�[0m

2022-09-02T11:09:25.6956605Z ##[debug]Processed: ##vso[task.issue type=error;]�[91mUpdate-Build: �[0m/home/vsts/work/_tasks/BuildVariableTask_115030de-9ced-4d2f-ad01-8c42d20d0327/2.9.12/BuildVariableTask.ps1:315%0A�[96mLine |%0A�[96m 315 | �[0m         �[96mUpdate-Build -tfsuri $collectionUrl -teamproject $teamproject�[0m …%0A�[96m     | �[91m         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~%0A�[91m�[96m     | �[91mCannot update the build, probably a rights issues see%0A�[96m     | �[91mhttps://github.com/rfennell/AzurePipelines/wiki/BuildTasks-Task (foot of page) to see notes on granting rights to the build user to edit build defintions%0A�[0m%0A
2022-09-02T11:09:25.6967074Z ##[debug]Processed: ##vso[task.complete result=Failed;]�[91mUpdate-Build: �[0m/home/vsts/work/_tasks/BuildVariableTask_115030de-9ced-4d2f-ad01-8c42d20d0327/2.9.12/BuildVariableTask.ps1:315%0A�[96mLine |%0A�[96m 315 | �[0m         �[96mUpdate-Build -tfsuri $collectionUrl -teamproject $teamproject�[0m …%0A�[96m     | �[91m         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~%0A�[91m�[96m     | �[91mCannot update the build, probably a rights issues see%0A�[96m     | �[91mhttps://github.com/rfennell/AzurePipelines/wiki/BuildTasks-Task (foot of page) to see notes on granting rights to the build user to edit build defintions%0A�[0m%0A
2022-09-02T11:09:25.6968657Z Script finished
2022-09-02T11:09:25.6998058Z ##[section]Finishing: Update Build Variable

I have read the Wiki more than once and I'm still not getting it. Has something in DevOps changed since the documentation was written? Am I missing something? Any help you can offer would be most appreciated.

Thank you

[rfennell]

I have re-written the documentation multiple times for this issue, not changing the fundamentals, but trying to explain it in a clearer way. It is hard to explain it seems.

The summary is the account the build is running as (probably the project or project collection build agent account) needs to be given permission to edit the build, release or pipeline definition template. By default all accounts only have read access to the templates. This is required as the variables are stored on the underlying template/definition no the build run.

This permission can either be set for a single pipeline or all definitions (use manage security on the ellipsis menu)

[dowdian]

I have confirmed that my settings look the same as yours. I am at a loss as to what I'm missing.

[rfennell]

Try changing the 'limit job authorization' switches, to swap between project and project collection scope

My permissions will look like this

You can see I grant edit definition permission to both the users (my team project is called Github

[dowdian]

You are an absolute wizard! Changing the 'limit job authorization' switch worked! Thank you so very much for sticking with me through this.

[rfennell]

You can see why I struggled with the documentation !

[dowdian]

...and now I see why. you have two users, one for the collection and one for just the project. I only have the one user for just the project. Hopefully our discussion here will help some hapless soul find the solution they need in the future without the need for your direct support.