So a new user walks up to you and tells you that they tried to get into Team Web Access by clicking on the URL that you gave them and they got an error saying “You do not have permission to access”. Ok, so what do you do? This is not done in the Team Project Collection Settings. It looks like you have to go and set up some server permissions according to the following MSDN article regarding Team Foundation Server Permissions
In the section about server-level permissions, it mentions that there are two ways to do it: using the administration console and using the TFSSecurity command line tool. I failed to find it in the administration console so I’m going to describe using the command line tool.
Log on to the team foundation server and open up a Visual Studio 2010 command prompt in Administrator mode. Now you are going to need a namespace first. Type in the following command to get the namespaces.
TFSSecurity /a /server:tfsserver
You don’t have to put in the http or the 8080, just the name of the server alone works. You should see WebAccess in the list. That’s the one you are looking for. Now to find the actions that can apply to that group, type in the following.
TFSSecurity /a WebAccess /server:tfsserver
You should see FullAccess in the list. Armed with the namespace and the action, you can change into an a+ command according to the reference http://msdn.microsoft.com/en-us/library/ms400715(v=vs.100).aspx you’ll then need an object, but I did not know what object to use. From the examples in the reference they used FrameworkGlobalSecurity. So I tried that and it worked like this.
TFSSecurity /a+ WebAccess FrameworkGlobalSecurity FullAccess n:Managers ALLOW /server:tfsserver
Something like this should mention Adding the access control array if successful. The user should be able to get to the Team Foundation Web Access site but you may not be out of the woods yet. Some lower level permissions may be required on the project collection and the project itself.
Also if your user does not need full permissions, then the Work Item Only View may be sufficient.