Set approval process to delete any project or repos of Azure Devops

Question

Set approval process to delete any project/repos of Azure DevOps(ADO). I have multiple owners in my private Azure Devops. From the docs it appears that any individual owner/users can go rogue and delete the entire Azure project/repo from existence though i know it can be restore easily in Azure devops within 28 days, But still I'd like to prevent that from happening.

Is there any way to set up Azure Devops user/group permissions such that deleting the repo requires the approval of its owners ? Kindly suggest if I missed the Azure docs if this feature is already there ?

Making myself the sole owner is not a viable solution, as I want to prevent myself (or an unauthorised user of my account) from having this power, too. So need to implement the approval process for this.

From below SS you can see it is not expecting any approval while deleting the whole project.

Answer 1

I'm afraid there is no such feature to approve delete request. However, you can set the delete permission of users to deny.

• Project:

If you want to delete a project, you must be a member of the Project Collection Administrators group or have the Delete team project permission set to Allow.

You can set this permission to deny if you don’t want other users to delete the project. Members in Project Administrators Group can manage permissions or groups at the project level and their delete project permission is allow by default.

• Repositories:

You can set the delete repository permission of users to deny. In addition, for most groups and almost all permissions, Deny overrides Allow. For members of the Project Collection Administrators or Team Foundation Administrators groups, Deny doesn't trump Allow.

Answer 2

Unfortunately, you read correctly. There isn't a way to require approval prior to repo deletion.

However, what you can do is create a group of users that you would want to be prevented from deleting repos and update the repo permissions to include an explicit deny for the "Delete Repository" permission: