We have a use case of wanting to use Managed Environment Deployment Pipelines to deploy solutions to Test and Production environments. However, we do not want end users to have any other privileges in the managed Test or Production environments outside of using the deployment pipelines. We don’t want them to be able to do manual deployment at all or to be able to create anything in those environments manually. With giving them the OOB Environment Maker/System Customizer to do pipeline deployments, we also give the rights to do manual deployments, which we don’t want.
Is that possible to implement the solution I am looking for?
Some ideas I am thinking about but really have no idea how to go about them would be to
- Create a custom role – I know how to create a custom role but am overwhelmed with all the privileges of the system customizer role. Would it be possible to create a copy and take away everything other than deployment capabilities and still have the deployment capability? If so what entitlements would we need to accomplish my requirements?
- Switch the pipeline to use a service account behind the scenes? Is it possible to have a pipeline do a deployment as a service account rather than the interactive user? That way I could give the service account the right permissions and now worry about the end user logging into the environment and doing stuff manually.
Has alone solved this problem or seen any good solutions?
