Configuring user security in Team Foundation Server can be confusing, since security has to be set at three levels: TFS, SharePoint and Reporting Services. Because it’s complex, many people resort to using the TFS Power Tools. The problem with this method is that you don’t ever really have a clear understanding of how security should be configured.
I took a bit of time to boil it down to its simplest form, and the result is this short and easy to follow document: Configuring User Security in TFS 2010.