SNFR20 - GitHub Teams Only

ID: SNFR20 - Category: Contribution/Support - GitHub Teams Only

All GitHub repositories that AVM modules are published from and hosted within MUST only assign GitHub repository permissions to GitHub teams.

Module ownership MUST be recorded in the respective Module Indexes. Per-module GitHub teams are not required; owner access is managed through the access package described below.

There MUST NOT be any GitHub repository permissions assigned to individual users.

Info

Non-FTE / external contributors (subject matter experts that aren’t Microsoft employees) can’t be members of the teams described in this chapter, hence, they won’t gain any extra permissions on AVM repositories, therefore, they need to work in forks.

Bicep

Note

Access management for Bicep module owners is governed centrally through Microsoft Entra. Per-module GitHub teams and parent-team assignments are no longer required.

All Bicep module owners, including primary and secondary owners, MUST request and obtain approval through the Azure Verified Modules (AVM) Module Contributors access package.

Your GitHub account MUST be linked to your corporate identity and be a member of the Azure organization.

Once approved, access is granted through the azure-verified-modules-module-contributors Entra group and the corresponding @Azure/azure-verified-modules-module-contributors GitHub team. This shared access does not replace the individual module ownership and review responsibilities recorded in the module indexes.

Bicep module owners MUST continue to work in forks of the BRM repository.

CODEOWNERS file

The BRM CODEOWNERS file assigns /avm/ to the shared @Azure/azure-verified-modules-module-contributors team. Module owners no longer need to create a GitHub team, request a parent-team assignment, or add a per-module CODEOWNERS entry when publishing or taking ownership of a module.

The repository-wide default and the *avm.core.team.tests.ps1 and *.e2eignore overrides remain assigned to @Azure/azure-verified-modules-tooling-contributors.

Tip

For the full onboarding process and ownership handover steps, see the Bicep Owner Contribution Flow.

Terraform

Note

Access management for Terraform repositories is governed centrally through Microsoft Entra. Module owner access is granted via an Entra access package — it is no longer managed through a per-module GitHub team or the legacy Core Identity entitlement.

All module owners MUST request access via the Azure Verified Modules (AVM) Module Contributors Entra access package:

Azure Verified Modules (AVM) Module Contributors — Access Package

Once approved, you are added to the azure-verified-modules-module-contributors Entra group, which is the source of truth for who is authorized to own and approve changes on AVM Terraform module repositories. Day-to-day repository access is then granted through this group together with just-in-time (JIT) elevation.

Tip

For the full onboarding process, see the Terraform Prerequisites and Repository Setup pages.