Feature/add dsc resource organization permisions

CHANGELOG.md

@@ -27,4 +27,13 @@
 
 - DSCV3 resources for: Project, Organization Permissions, Project Permissions
 
+## [1.0.3] - 2026-06-12
+
+### Added
+
+- DSCv3 - native resources: OrganisationPermissions User nad group
+- PowerShell DSC resources - OrganisationPermissions User nad group
+- Update documentation
+
+
 

docs/AzureDevOpsDscv3-native.md

@@ -20,6 +20,8 @@ This guide covers how to copy the native DSC v3 resource files to a working dire
 | `AzureDevOps/Project` | `dsc-resources/project/` | Create / update / delete an ADO project |
 | `AzureDevOps/OrganizationUser` | `dsc-resources/organization-user/` | Manage user entitlement (access level) in an organization |
 | `AzureDevOps/OrganizationGroup` | `dsc-resources/organization-group/` | Manage Entra group entitlement (license rule) in an organization |
+| `AzureDevOps/OrganizationUserPermission` | `dsc-resources/organization-user-permission/` | Add / remove a user from an organization-level (Project Collection) security group |
+| `AzureDevOps/OrganizationGroupPermission` | `dsc-resources/organization-group-permission/` | Add / remove an Entra group from an organization-level (Project Collection) security group |
 | `AzureDevOps/ProjectUserPermission` | `dsc-resources/project-user-permission/` | Add / remove a user from a project-level security group |
 | `AzureDevOps/ProjectGroupPermission` | `dsc-resources/project-group-permission/` | Add / remove an Entra group from a project-level security group |
 
@@ -39,6 +41,8 @@ $resources = @(
     "project",
     "organization-user",
     "organization-group",
+    "organization-user-permission",
+    "organization-group-permission",
     "project-user-permission",
     "project-group-permission"
 )
@@ -65,6 +69,8 @@ $env:DSC_RESOURCE_PATH = @(
     "$base\project",
     "$base\organization-user",
     "$base\organization-group",
+    "$base\organization-user-permission",
+    "$base\organization-group-permission",
     "$base\project-user-permission",
     "$base\project-group-permission"
 ) -join ";"
@@ -93,11 +99,13 @@ dsc resource list | Select-String "AzureDevOps"
 Expected output:
 
 ```
-AzureDevOps/OrganizationGroup         0.1.0
-AzureDevOps/OrganizationUser          0.1.0
-AzureDevOps/Project                   0.1.0
-AzureDevOps/ProjectGroupPermission    0.1.0
-AzureDevOps/ProjectUserPermission     0.1.0
+AzureDevOps/OrganizationGroup             0.1.0
+AzureDevOps/OrganizationGroupPermission   0.1.0
+AzureDevOps/OrganizationUser              0.1.0
+AzureDevOps/OrganizationUserPermission    0.1.0
+AzureDevOps/Project                       0.1.0
+AzureDevOps/ProjectGroupPermission        0.1.0
+AzureDevOps/ProjectUserPermission         0.1.0
 ```
 
 If a resource is missing, verify:

docs/AzureDevOpsDscv3-parameters.md

@@ -9,6 +9,10 @@ This document describes the parameters for each DSC resource included in the Azu
 - [ProjectResource](#projectresource)
 - [OrganizationUserResource](#organizationuserresource)
 - [OrganizationGroupResource](#organizationgroupresource)
+- [OrganizationUserPermissionResource](#organizationuserpermissionresource)
+- [OrganizationGroupPermissionResource](#organizationgrouppermissionresource)
+- [ProjectUserPermissionResource](#projectuserpermissionresource)
+- [ProjectGroupPermissionResource](#projectgrouppermissionresource)
 
 ---
 
@@ -64,10 +68,46 @@ Manages Azure DevOps group entitlements for an organization.
 | `pat` | Personal access token used for authentication | None | ✅ Yes |
 | `apiVersion` | Azure DevOps REST API version | `7.1-preview.1` | ❌ No |
 
+---
 
-## ProjectnGroupResource
+## OrganizationUserPermissionResource
 
-Manages Azure DevOps group entitlements for an organization.
+Manages a user's membership in an organization-level (Project Collection) Azure DevOps security group.
+
+### Parameters
+
+| Parameter | Description | Default Value | Required |
+|-----------|-------------|---------------|----------|
+| `UserPrincipalName` | User principal name (email) to add or remove | None | ✅ Yes |
+| `Organization` | Azure DevOps organization name | None | ✅ Yes |
+| `PermissionLevel` | Organization-level group: `ProjectCollectionAdministrators`, `ProjectCollectionBuildAdministrators`, `ProjectCollectionBuildServiceAccounts`, `ProjectCollectionProxyServiceAccounts`, `ProjectCollectionServiceAccounts`, `ProjectCollectionTestServiceAccounts`, `ProjectCollectionValidUsers`, `ProjectScopedUsers`, or `SecurityServiceGroup` | None | ✅ Yes |
+| `Ensure` | Desired state: `Present` or `Absent` | `Present` | ❌ No |
+| `pat` | Personal access token used for authentication | None | ✅ Yes |
+| `apiVersion` | Azure DevOps REST API version | `7.1-preview.1` | ❌ No |
+
+---
+
+## OrganizationGroupPermissionResource
+
+Manages an Entra (Azure AD) security group's membership in an organization-level (Project Collection) Azure DevOps security group. If the Entra group is not yet linked to the organization it is added automatically.
+
+### Parameters
+
+| Parameter | Description | Default Value | Required |
+|-----------|-------------|---------------|----------|
+| `GroupOriginId` | Origin ID (Object ID) of the Entra security group | None | ✅ Yes |
+| `GroupDisplayName` | Display name of the Entra security group (for reference) | None | ❌ No |
+| `Organization` | Azure DevOps organization name | None | ✅ Yes |
+| `PermissionLevel` | Organization-level group: `ProjectCollectionAdministrators`, `ProjectCollectionBuildAdministrators`, `ProjectCollectionBuildServiceAccounts`, `ProjectCollectionProxyServiceAccounts`, `ProjectCollectionServiceAccounts`, `ProjectCollectionTestServiceAccounts`, `ProjectCollectionValidUsers`, `ProjectScopedUsers`, or `SecurityServiceGroup` | None | ✅ Yes |
+| `Ensure` | Desired state: `Present` or `Absent` | `Present` | ❌ No |
+| `pat` | Personal access token used for authentication | None | ✅ Yes |
+| `apiVersion` | Azure DevOps REST API version | `7.1-preview.1` | ❌ No |
+
+---
+
+## ProjectGroupPermissionResource
+
+Manages Azure DevOps project-level security group membership for an Entra (Azure AD) security group.
 
 ### Parameters
 
@@ -83,9 +123,9 @@ Manages Azure DevOps group entitlements for an organization.
 | `apiVersion` | Azure DevOps REST API version | `7.1-preview.1` | ❌ No |
 
 
-## ProjectUserResource
+## ProjectUserPermissionResource
 
-Manages Azure DevOps user entitlements for an organization.
+Manages Azure DevOps project-level security group membership for a user.
 
 ### Parameters
 

dsc-config/devops.example.dsc-powershell.config.yaml

@@ -0,0 +1,55 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+parameters:
+  Token:
+    type: string
+    defaultValue: PAT-Token
+resources:
+- name: Working with classic DSC resources for ADO v4
+  type: Microsoft.Windows/WindowsPowerShell
+  properties:
+    resources:
+    - name: Create ADO project - DSC
+      type: AzureDevOpsDscv3/ProjectResource
+      properties:
+        Organization: ExampleOrganization
+        ProjectName: TestDSC
+        Description: "Project created via DSC v3 with secure parameters"
+        pat: "[parameters('Token')]"
+        SourceControlType: Git
+        Ensure: Present
+    - name: AddUser
+      type: AzureDevOpsDscv3/OrganizationUserResource
+      properties:
+        UserPrincipalName: UserPrincipalName
+        Organization: ExampleOrganization
+        AccessLevel: Basic  # or Stakeholder, BasicPlusTestPlans
+        Ensure: Present
+        pat: "[parameters('Token')]"
+    - name: AddGroup
+      type: AzureDevOpsDscv3/OrganizationGroupResource
+      properties:
+        GroupOriginId: EntraID-GroupObjectID   # group descriptor
+        GroupDisplayName: EntraID-GroupDisplayName
+        Organization: ExampleOrganization
+        AccessLevel: Basic
+        Ensure: Present
+        pat: "[parameters('Token')]"
+    - name: AddPermissionProject
+      type: AzureDevOpsDscv3/ProjectUserPermissionResource
+      properties:
+        ProjectName: TestDSCv11
+        PermissionLevel: ProjectAdministrators  # ProjectAdministrators, ProjectValidUsers, Readers, or ReleaseAdministrators.
+        UserPrincipalName: UserPrincipalName
+        Organization: ExampleOrganization
+        Ensure: Absent
+        pat: "[parameters('Token')]"
+    - name: AddPermissionProject
+      type: AzureDevOpsDscv3/ProjectGroupPermissionResource
+      properties:
+        ProjectName: TestDSCv11
+        PermissionLevel: ProjectAdministrators  # ProjectAdministrators, ProjectValidUsers, Readers, or ReleaseAdministrators.
+        GroupDisplayName: EntraID-GroupDisplayName
+        GroupOriginId: EntraID-GroupObjectID   # group descriptor
+        Organization: ExampleOrganization
+        Ensure: Absent
+        pat: "[parameters('Token')]"

dsc-config/devops.organization.dsc-native.config.yaml

@@ -0,0 +1,41 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+
+# ---------------------------------------------------------------------------
+# Example DSC v3 configuration using native AzureDevOps resources
+# ---------------------------------------------------------------------------
+# Prerequisites:
+#   - pwsh (PowerShell 7+) installed and on PATH
+#   - dsc-resources\ folder on DSC_RESOURCE_PATH (or in the same directory)
+#   - A valid PAT stored in environment variable ADO_PAT
+#
+# Run:
+#   $env:DSC_RESOURCE_PATH = "D:\Git\AzureDevOpsDscv3\dsc-resources\project;D:\Git\AzureDevOpsDscv3\dsc-resources\organization-user;D:\Git\AzureDevOpsDscv3\dsc-resources\organization-group;D:\Git\AzureDevOpsDscv3\dsc-resources\project-user-permission;D:\Git\AzureDevOpsDscv3\dsc-resources\project-group-permission"
+#   dsc config set --document devops.example.dsc.config.yaml --parameters devops.example.dsc.config.parameters.yaml
+# ---------------------------------------------------------------------------
+
+parameters:
+  Organization:
+    type: string
+    defaultValue: YourOrganizationName
+  Token:
+    type: string
+    defaultValue: "*************************************"
+
+resources:
+  - name: OrganizationUserPermission
+    type: AzureDevOps/OrganizationUserPermission
+    properties:
+      userPrincipalName: tomasz.kot@mmachniak.net
+      organization: "[parameters('Organization')]"
+      permissionLevel: ProjectCollectionAdministrators
+      ensure: Present
+      pat: "[parameters('Token')]"
+  - name: OrganizationGroupPermission
+    type: AzureDevOps/OrganizationGroupPermission
+    properties:
+      groupOriginId: "00000000-0000-0000-0000-000000000000"
+      groupDisplayName: Security Group Name
+      organization: "[parameters('Organization')]"
+      permissionLevel: ProjectCollectionAdministrators
+      ensure: Present
+      pat: "[parameters('Token')]"

dsc-config/devops.organization.dsc-powershell.config.yaml

@@ -0,0 +1,31 @@
+$schema: https://aka.ms/dsc/schemas/v3/bundled/config/document.json
+parameters:
+  Organization:
+    type: string
+    defaultValue: YourOrganization
+  Token:
+    type: string
+    defaultValue: "**********"
+
+resources:
+- name: Working with classic DSC resources for ADO Organization permissions
+  type: Microsoft.Windows/WindowsPowerShell
+  properties:
+    resources:
+    - name: OrgznationUserPermission
+      type: AzureDevOpsDscv3/OrganizationUserPermissionResource
+      properties:
+        UserPrincipalName: dev@contoso.com
+        Organization: "[parameters('Organization')]"
+        PermissionLevel: ProjectCollectionAdministrators
+        Ensure: Present
+        pat: "[parameters('Token')]"
+    - name: OrganizationGroupPermission
+      type: AzureDevOpsDscv3/OrganizationGroupPermissionResource
+      properties:
+        GroupOriginId: "00000000-0000-0000-0000-000000000000"   # group descriptor
+        GroupDisplayName: GBA-AAD-ADO-Organization-permissions-DSC
+        Organization: "[parameters('Organization')]"
+        PermissionLevel: ProjectCollectionAdministrators
+        Ensure: Present
+        pat: "[parameters('Token')]"