How to get subject id of Build Service - azure-devops

Question

I am trying to configure permission in Azure DevOps using az devops cli following this answer (Assigning group permissions using to Azure DevOps CLI).
I successes update Force Push to Allow For Contributors group, using this command line:
az devops security permission update `
--id $namespaceId `
--subject $subject `
--token "$repoV2" `
--allow-bit $bit `
--merge true `
--org https://dev.azure.com/$org/
I extracted subject id by this command:
$subject = az devops security group list `
--org "https://dev.azure.com/$org/" `
--scope organization `
--subject-types vssgp `
--query "graphGroups[?#.principalName == 'ForcePush'].descriptor | [0]"
Now I want to do give Contribute (GenericContribute) to ProjectName Build Service (organization), (note: with red question mark in image). It is neither a user nor group, even thus it is under users category. How can I change permission for this using command line?
Note: It will be fine for me if the solution either az devops cli, rest api or graphs api.

Answer 1

Update:
Original Answer:
Refer to this official document so that we will know the namespace id:
https://learn.microsoft.com/en-us/azure/devops/organizations/security/namespace-reference?view=azure-devops
namespace id in your situation is: '2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87'
How to achieve your requirements:
Just Send API call to this:
https://dev.azure.com/<Organization Name>/_apis/AccessControlEntries/2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87
Request Method:
POST
Request Body:
{
"token": "repoV2/<Project ID>/<repo ID>/",
"merge": true,
"accessControlEntries": [
{
"descriptor": "Microsoft.TeamFoundation.ServiceIdentity;<Organization ID>:Build:<Project ID>",
"allow": 4,
"deny": 0,
"extendedInfo": {
"effectiveAllow": 4,
"effectiveDeny": 0,
"inheritedAllow": 4,
"inheritedDeny": 0
}
}
]
}
How to get the above IDs:
1, Organization ID.
I will suggest a simple method here(Of course you can try to use API to get it):
Turn on the browser, press F12 to turn on the debug mode and then go to this place:
https://dev.azure.com/<Organization Name>/
After that, search this: https://spsprodsea2.vssps.visualstudio.com/
You will get the organization ID here:
2, Project ID.
Just follows this API:
https://dev.azure.com/<Organization Name>/_apis/projects?api-version=6.0
https://learn.microsoft.com/en-us/rest/api/azure/devops/core/projects/list?view=azure-devops-rest-6.0
Just search the name in the response and you will get the ID. In this situation, the project build service account is managed via project id.
3, Repository ID.
https://dev.azure.com/<Organization Name>/<Project Name>/_apis/git/repositories?api-version=6.0
https://learn.microsoft.com/en-us/rest/api/azure/devops/git/repositories/list?view=azure-devops-rest-6.0
Search the repository name and you will get the ID.
Success on my side:

Answer 2

To get the organization Id dynamically you just have to retrieve the value of the System.CollectionId variable as following:
$orgId = $(System.CollectionId)
Documentation: https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#system-variables-devops-services