This program makes all TFS/Azure DevOps TVFC workspaces of a specific user public

ChangeAllWorkspacesToPublic.cs

// Add from Nuget: Microsoft.TeamFoundationServer.ExtendedClient
using Microsoft.TeamFoundation.Client;
using Microsoft.TeamFoundation.Framework.Client;
using Microsoft.TeamFoundation.Framework.Common;
using Microsoft.TeamFoundation.VersionControl.Client;
using Microsoft.TeamFoundation.VersionControl.Common;
using System;
using System.Text;
using IdentityNotFoundException = Microsoft.TeamFoundation.VersionControl.Client.IdentityNotFoundException;

namespace ChangeWorkspacesToPublic
{
    internal class ChangeAllWorkspacesToPublic
    {
        internal static string Do(string URL, string domainBackslashUser, bool makePublic)
        {
            StringBuilder sb = new StringBuilder();

            WorkspacePermissions allWorkspacePermissions = WorkspacePermissions.Read | WorkspacePermissions.Use | WorkspacePermissions.CheckIn | WorkspacePermissions.Administer;



            TfsConfigurationServer configurationServer = TfsConfigurationServerFactory.GetConfigurationServer(new Uri(URL));
            configurationServer.Authenticate();

            var collectionNodes = configurationServer.CatalogNode.QueryChildren(new[] { CatalogResourceTypes.ProjectCollection }, true, CatalogQueryOptions.None);
            foreach (var collectionNode in collectionNodes)
            {
                collectionNode.GetType();
                var collectionId = new Guid(collectionNode.Resource.Properties["InstanceId"]);
                TfsTeamProjectCollection teamProjectCollection =
                    configurationServer.GetTeamProjectCollection(collectionId);

                VersionControlServer versionControl = teamProjectCollection.GetService<VersionControlServer>();
                Workspace[] workspaces;
                try
                {
                    workspaces = versionControl.QueryWorkspaces(null, domainBackslashUser, null);
                }
                catch (IdentityNotFoundException)
                {
                    // User not defined in this collection. Ignore
                    continue;
                }

                sb.AppendLine("*** " + teamProjectCollection.DisplayName + " ***");

                ISecurityService security = teamProjectCollection.GetService<ISecurityService>();
                SecurityNamespace workspaceSecurityNamespace = security.GetSecurityNamespace(SecurityConstants.WorkspaceSecurityNamespaceGuid);

                foreach (var workspace in workspaces)
                {
                    sb.AppendLine("\t" + workspace.Name + string.Join(", ", workspace.OwnerAliases));
                    sb.AppendLine("\t\t" + workspace.SecurityToken);

                    AccessControlList acl = workspaceSecurityNamespace.QueryAccessControlList(workspace.SecurityToken, null, true);
                    bool isPublic = false;
                    foreach (var ace in acl.QueryAccessControlEntries(null))
                    {
                        sb.AppendLine("\t\t\t" + ace.Allow + " " + ace.Deny + ace.Descriptor.IdentityType + ", " + ace.Descriptor.Identifier + "," + ace.Descriptor.Data+ "==" + ace.ToString());
                        if (ace.Allow == 15 &&
                            ace.Deny == 0 &&
                            ace.Descriptor.IdentityType == GroupWellKnownDescriptors.EveryoneGroup.IdentityType &&
                            ace.Descriptor.Identifier == GroupWellKnownDescriptors.EveryoneGroup.Identifier)
                            isPublic = true;
                    }
                    sb.AppendLine("" + isPublic);

                    if (!isPublic && makePublic)
                    {
                        acl.SetAccessControlEntry(new AccessControlEntry(GroupWellKnownDescriptors.EveryoneGroup, (int)allWorkspacePermissions, 0), true);
                        workspaceSecurityNamespace.SetAccessControlList(acl);
                    }
                }
            }

            return sb.ToString();
        }
    }
}