Help to determine why Azure Devops repository permissions are not showing all groups

Question

We are transitioning to a single Azure Devops project (https://learn.microsoft.com/en-us/azure/devops/organizations/projects/about-projects?view=azure-devops#use-a-single-project), from multiple projects. For the sake of this, let's call the single project 'foobar' The idea here is that not all users should see every repository, so I don't think we can really use the default Contributors group across the project as it's meant to be used, but that's outside of scope with this particular problem I'm reporting. As I move external teams into this foobar single project, I have been essentially performing the following for every project I consolidate (note: for the sake of this ticket, I'm not mentioning anything about how I'm restoring the repos + work items, as that is out of scope with the problem I'm seeing) :

• Create the Teams (Team A, B, C, etc), via Project Settings -> Teams -> New Team
• For each repo that the team should have access to, I grant the group permission via Project Settings -> Repositories -> repositoryX -> Security -> (select the respectful group here)

The above process worked well for the first 2-3 teams I created. However, now that I have many teams (only 4 or 5 so far), I am running into an issue.
The problem is that when I go to Project Settings -> Repositories -> repositoryD -> Security, I do not see group D in the "Search for users or groups" drop-down, as seen below. Although I can still see groups A, B, and C. I even see some groups that I deleted and no longer show up under Settings/Permissions/Groups, yet they still show up in this drop-down.

Note that I have not even got to the part where I'll need to test modifying the default Contributor access here, so I know that's not related (and that itself could cause me a whole bunch of other permissions problems - but like I mentioned, that's outside the scope of this problem here).
The problem as you can see is that groups I can see under Settings/Permissions/Groups, are not showing up when I try to add them to a specific repository. The search in the drop down is also useless. Anything I search for - I get zero results, even if it's one of the groups that I actually can click on when I otherwise have nothing typed into this search box. For example, when I click on it, I see a group called FOO. I can click on FOO and assign permissions. But if I type FOO, I get zero results. Is there a limit to the number of security groups allowed in Azure Devops? Or is this a bug with Devops? It definitely feels very buggy, especially since the old groups are still showing up in the search bar, and search not working. I even waited overnight and these groups are still not showing up in that drop down. PS - can you please add an 'azure devops' tag in here?

Answer 1

I figured out the problem to my initial issue. Like I mentioned, my goal is to limit access to certain repositories for members of a team. When you create a new team, the default permission is the Contributors group. I don't want to select the Readers group here either, because that still provides access to all of the repositories. What I did was:

• create a team, leave permissions as default (Contributors)
• Go to Settings -> Permissions -> Select the team I just created -> Member of -> (remove Contributors, add "<TeamName> team").
• Go to Settings -> Repositories -> (Select a repo this team should have access to) -> Security -> (type the name of the team you just created) and now it pops up in the quick find and you can add it.

I've found that if you leave only the "Project Valid Users" group as a member of the team you created, this team will NOT show up in the search box. But if you add this team to the default "<TeamName> Team" group (Readers, or Contributors, etc), only then will you actually be able to assign permissions to the team. Somewhat related: If you were to add a new user as a team member, but they are not part of the "<TeamName> Team" (at minimum), that user will not have access to the repositories even though they are on the Team you added them to, which inherently puts them in the Valid Project Users group).