In order to allow a TFS user in some Team Project to manage value lists in the "Global Lists" at team system level, such a user needs to be given "Edit Collection Level Information" permission. This is needed cause we need to enable this user to maintain value lists for a customization of field within the Work Items of the team project, based on some dependency rule that relates to Global Lists.
Problem is there's no possibility to give this user permission only to change Global Lists, as there's only possibility to give him "edit collection level info" and that will give him possibility to manage the Global List, but would also yield him access to add / remove groups at collection level and change source control permissions globally, which is something our infra obviously would not want to give a regular user, be it even a team project admin.
So, is there a way to give the permissions of "edit collection level info" and yet deny anything it specifically yields other than edit Global List permission ? If not, is there any means to generate an alert on any change that such a user does at collection level as result of such permission ? Or some other reasonable means to monitor what this user does at collection level ? It is not a matter of trust but rather of course a case in which such a user could inadvertently change something that could influence the stability of the collection as a whole - and the only thing that is actually needed is for the user to manage Global Lists.
It is possible of course to do the Global List changes by the TFS admin, for thiis user, but that could make the TFS admin a bottle neck for simple maintaining value lists for a simple field in some wi in the respective team project. Maybe there's another way to implement value list for a field in case it is a value list that's required to be available for the customized field in all the work items of the team project, rather than to place the value list in Global List ?
Would appreciate a helpful answer. Thank u very much