WorkItem only view in TFS 2010 Web Access

Here is an excellent how-to. It covers the very simple scenario as well as more complex approach (in case you need to deal with multiple customers and need more granual settings).
However, there's one glitch that is not mentioned there. TFS has a nasty habit of not picking up domain changes right-away. So if you just created the user & group in your domain, set everything up according to the how-to, you may end up with an error:

Access Denied: {your user} needs the following permission(s) to perform this action: View instance-level information

There's a thread describing the issue. In essence you have a choice of:

• wait for a bit (30 minutes or so) and TFS will pick it up eventually
• restart the TFS server
• instead of using group, use user credentials directly (probably not the best option though)