How Permissions with Azure DevOps and it’s API work

#uncomment below if you don't have the module
#Install-Module -Name VSTeam

$org = "#Org#"
$pat = "#Pat#"
$projectName = "#Project#"
$GroupName = "#GroupName#"
$Description = "#GroupDescription#"

Set-VSTeamAccount -Account $org -PersonalAccessToken $pat


##### Get the permissions we want to Deny here in these calls #####

#get namespaces for different security permissions and their needed bit masks
$namespaces = (Get-VSTeamSecurityNamespace) | Sort-Object Name
#permission bit mask / namespace for projects
$projectNameSpace = $namespaces | Where-Object Name -eq Project
#say which permissions we want to have denied. So called 'Actions' can be vied by looking into the contents of $projectNameSpace
$permissionsDeny = @("UPDATE_VISIBILITY", "MANAGE_PROPERTIES", "GENERIC_WRITE", "DELETE", "WORK_ITEM_PERMANENTLY_DELETE")


#handle everything on a project
$project = Get-VSTeamProject -Name $projectName
#get the descriptor for this projects. This is they key for connecting the permission bit masks to the project in the ACL (Access Control Lists)
$projectDescriptor = Get-VSTeamDescriptor -StorageKey $project.ID


#create the group
$groupBody = @{
    displayName = $GroupName
    description = $Description
}
$jsonBody = $groupBody | ConvertTo-Json -Compress -Depth 100

$group = Invoke-VSTeamRequest `
    -NoProject `
    -method POST `
    -subDomain vssps -area Graph -resource Groups `
    -version "5.1-preview.1" `
    -body $jsonBody `
    -QueryString @{scopeDescriptor = $projectDescriptor.Descriptor } `
    -contentType "application/json"



$projectPermissions = $projectNameSpace.Actions | Where-Object { $permissionsDeny.Contains($_["Name"]) }
$projectPermissions | ForEach-Object {

    $permission = $_

    #to get the correct descriptor we have to take the group descriptor which is base64 encoded.
    # for PowerShell I have to add '==' and remove the non Base64 character 'vssgp.' (meaning it is a descriptor for a AzD native group... not AAD)
    $decodedDescriptor = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("$($group.descriptor -replace "vssgp.",'')=="))

    #if this is not odd enough I have to add certain other strings to token and the descriptor reference for the ACE
    # if you want 'Deny' you need to ad the given bit to 'DenyMask'
    # if you want 'Allow' you need to ad the given bit to 'AllowMask'
    Add-VSTeamAccessControlEntry `
        -SecurityNamespaceId $projectNameSpace.ID `
        -Token "`$PROJECT:$($group.domain):" `
        -Descriptor "Microsoft.TeamFoundation.Identity;$decodedDescriptor" `
        -AllowMask 0 `
        -DenyMask $permission.Bit
}