There is a command group 'az_devops_security_permission'. This group of commands could 'manage security permissions'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_devops_security_permission_update'.The syntax is: az devops security permission update --id
                                     --subject
                                     --token
                                     [--allow-bit]
                                     [--deny-bit]
                                     [--detect {false, true}]
                                     [--merge {false, true}]
                                     [--org]. The 1th example of the child command would be to use it to 'assign view  edit and delete permission for team projects', the syntax is: az devops security permission update  --allow-bit 7 --namespace-id            52d39943-cb85-4d7f-8fa8-c6baac873819 --subject user@fabrikam.com            --token "`$PROJECT:vstfs:///Classification/TeamProject/e479xxxx-2be8-xxxx-bb0b-3a0209cxxxx"

You would need to add the bit value of the various permission bits to
simultaneously allow/deny multiple permissions.. The parameter '--id --namespace-id' is required. It is used to id of security namespace.. The parameter '--subject' is required. It is used to user email id or group descriptor.. The parameter '--token' is required. It is used to security token.. The parameter '--allow-bit' is optional. allow bit or addition of bits. required if --deny-bit is missing.. The parameter '--deny-bit' is optional. deny bit or addition of bits. required if --allow-bit is missing.. The parameter '--detect' is optional. automatically detect organization.. The parameter '--merge' is optional. if set, the existing ace has its allow and deny merged with                          the incoming ace's allow and deny. if unset, the existing ace is displaced.. The parameter '--org --organization' is optional. azure devops organization url. you can configure the default organization using az devops configure -d organization=org_url. required if not configured as default or picked up via git config. example: https://dev.azure.com/myorganizationname/.. 