title: VSTS NuGet Publisher - 403 (Forbidden) Error
body: <p>I have created a build definition in Team Services which needs to run on a private agent (i.e. on-premise build server). This agent is running under a domain account. I then created a NuGet feed in Team Services to which I am trying to publish a package created by the NuGet Packager task.</p>
  
  <p>I am getting an authentication error (403 Forbidden) when trying to push a package to the internal feed using the NuGet Publisher Task (NuGet v4.0.0.2283) :</p>
  
  <pre><code>2017-05-04T21:05:06.3076014Z CredentialProvider.TeamBuild: Failed to authenticate to https://mycompany.pkgs.visualstudio.com/_packaging/MyProject/nuget/v3/index.json from your project collection, prefix = https://mycompany.pkgs.visualstudio.com/
  2017-05-04T21:05:07.8546075Z System.AggregateException: One or more errors occurred. ---&gt; NuGet.Protocol.Core.Types.FatalProtocolException: Unable to load the service index for source https://mycompany.pkgs.visualstudio.com/_packaging/MyProject/nuget/v3/index.json. ---&gt; System.Net.Http.HttpRequestException: Response status code does not indicate success: 403 (Forbidden).
  </code></pre>
  
  <p>Please note that I am able to publish the same package manually on the build server using my credentials as decribed here : <a href="https://www.visualstudio.com/en-us/docs/package/nuget/nuget-exe" rel="nofollow noreferrer">https://www.visualstudio.com/en-us/docs/package/nuget/nuget-exe</a></p>
  
  <p>Now, the build definition is project scoped (not Project Collection scoped). Therefore, the default permissions which add the <strong>Project Collection Build</strong> Service account to the contributors of the feed is probably incorrect.
  I believe the <strong>Project Build</strong> Service account associated with this specific team project needs to be added to the contributors (or owners).</p>
  
  <p>Since there are 15+ projects in this Team Services account and the Project Build Service accounts all have the same name, finding the correct account requires some work. I managed to find the specific Project Build Service account guid by addding the following PowerShell inline script to the build (which I got from here : <a href="https://github.com/Microsoft/vsts-tasks/issues/3287" rel="nofollow noreferrer">https://github.com/Microsoft/vsts-tasks/issues/3287</a>):</p>
  
  <pre><code>$headers = @{Authorization="Bearer ${env:SYSTEM_ACCESSTOKEN}"}
  $response = Invoke-RestMethod "${env:SYSTEM_TEAMFOUNDATIONCOLLECTIONURI}/_apis/connectionData" -Headers $headers 
  $response.authenticatedUser | Format-List id, customDisplayName | Out-Host
  </code></pre>
  
  <p>Now, I cannot seem to add the Project Build Service account to the contributors of the feed, either by typing its guid or by typing "Project Build Service" to find the one with the correct guid from the list of accounts.</p>
  
  <p>Is this a bug or did I forget to configure something ?</p>