Is there a way to restrict "Work Item Import via CSV"?
Accepted answer
Have you seen a permission for work item import?
I was unable to find one so the only permission is Save Work Item and the related permissions. RTC does not distinguish between import and other work item operations. If you think about it, it would also be error prone to have to maintain different permissions and the server actually can not even know if something is an import, unless the client tells it.