Build agent can be installed on any computer that has access to the Team Foundation Server application tier. The build process can be customized to run any user-supplied code that will be run with greater permissions on the build agent. Therefore, user code can perform certain actions that may not be able to run on their development computer. Similarly, certain deployment steps that are part of the build may require administrative permissions. Therefore, if the Visual Studio Team Foundation Build service account is part of the local administrators group on the build computer, running any user code will have administrative permissions. If Team Foundation Build is installed on the application tier, the user could be a security risk. Similarly, on the data tier, local administrators can change the database and potentially perform insecure actions.
Consider the following points when configuring your topology with Team Foundation Build:
Security risks are introduced by installing Team Foundation Build on either the application tier or the data tier.
Running user code from an untrustworthy source could compromise the information on the computer.