Add a Private Marketplace

What you'll build

A private GitHub or Azure DevOps repository registered as a marketplace source, with a plugin installed from it and its skills available in your agent.

Prerequisites

• An Azure SRE Agent in Running state
• SRE Agent Author or Administrator role on the agent. Setting up an Azure DevOps credential also needs memory/write (Standard User plus Author, or Administrator). See User roles.
• The Plugins page visible under Builder in the sidebar
• A GitHub or Azure DevOps repository containing a marketplace.json manifest with at least one plugin
• A credential with read access to the repository

Step 1: Open Connect marketplace

Open Plugins and select Connect marketplace. If you already have marketplaces, select Add marketplace in the list that opens.

Step 2: Enter the repository URL

In Marketplace URL or owner/repo, enter your repository.

• GitHub: myorg/internal-skills or https://github.com/myorg/internal-skills
• Azure DevOps: https://dev.azure.com/<organization>/<project>/_git/<repository> or https://<organization>.visualstudio.com/<project>/_git/<repository>

For Azure DevOps, remove the <organization>@ prefix that Azure DevOps adds when you copy a clone URL. URLs that include DefaultCollection aren't supported. The dialog fills in Marketplace name from the repository name; change it if another marketplace already uses that name.

Step 3: Authenticate

Azure DevOps

The marketplace uses the organization's connection from Builder > Code access. If a working connection exists, go to Step 4.

Otherwise, select Set up credentials and add and choose a method:

Method	What to provide
Your account	Select Sign in to Azure DevOps and sign in with an account that can read the repository.
PAT	Enter a personal access token with Code (Read) scope, then select Connect.
Managed Identity	An identity attached to the agent with Read access to the repository. For federated identity credentials (FIC), also enter the federated client ID and tenant ID. See Managed identity and FIC setup.

The credential becomes the agent's shared connection for that organization, including Code access. Prefer a PAT or managed identity limited to the repositories you need over your personal account.

After the credential saves, the dialog adds the marketplace for you. Cancel doesn't remove a credential that has already been saved.

GitHub

If your agent's GitHub OAuth identity has access to the repo (same org or authorized OAuth App), you're ready. Skip to Step 4.

If the repo is in an org your agent can't reach, expand the Advanced section and enter a personal access token with read access to the repository.

PATs are only supported for github.com

For GitHub Enterprise (*.ghe.com) hosts, PATs are not accepted. Use a GitHub App instead (see below).

Create your PAT at github.com/settings/personal-access-tokens with Contents: Read scope on the target repository.

For GitHub Enterprise (*.ghe.com), the dialog shows a GitHub App registration form instead:

• Client ID: the App's client ID
• Private key URI (Key Vault): Azure Key Vault key URI for the App's private key (e.g., https://myvault.vault.azure.net/keys/my-ghe-app-key). The key must have the Sign operation enabled.
• Key Vault identity: the managed identity with Key Vault Crypto User role on the key

Select Configure GitHub App to register the connection. Wait until the dialog shows Connected via GitHub App before proceeding.

Step 4: Add the marketplace

Select Add. (After Azure DevOps credential setup, this happens automatically.)

The repository clones in the background. When it finishes, a notification says the marketplace is ready and its plugins show in the grid. If the clone fails, the Plugins page shows a Failed to clone banner with a Retry button.

If this happens	What to do
The dialog can't check the Azure DevOps connection	Select Retry.
The credential saved but adding the marketplace failed	Select Retry. Your credential is kept.
A managed identity warning appears	The credential is saved. Check the warning, the identity's organization membership, and its repository Read access.

If someone later removes or changes the organization's connection in Builder > Code access, the marketplace stops refreshing. Refreshes resume on the next periodic sync after the connection is fixed.

Step 5: Install a plugin

Select a plugin card to open its detail page. Review the skills it contains, then select Install.

Checkpoint: The plugin shows "installed successfully with N skills." The skill is available in Builder > Skill builder.

Shared credential boundary

Repository access uses the agent's credential, not each user's identity. Any user with the Author or Administrator role can register marketplaces and install from them, even without personal access to the repository. See Shared credential boundary.

tip

If the clone fails, check that the credential can read the repository. GitHub fine-grained PATs need Contents: Read; Azure DevOps PATs need Code (Read). For OAuth, check the account's access and the app's authorization.

Using the REST API

You can add a private marketplace and manage installations via the REST API:

# Add a private marketplace with PAT
curl -X POST "https://<agent-endpoint>/api/v2/plugins/marketplaces" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "metadata": { "name": "my-private-marketplace" },
    "spec": {
      "sourceType": "github",
      "sourceUrl": "myorg/private-skills",
      "owner": { "name": "myorg" },
      "credentials": {
        "authMethod": "pat",
        "pat": "ghp_your_token_here"
      }
    }
  }'

Omit the credentials field when the agent's host-level GitHub identity already has access.

For Azure DevOps, set up the organization's Code access connection first. Then submit sourceType: "git-url" with the full clone URL, set owner.name to the organization, and omit credentials.

# List marketplaces
curl "https://<agent-endpoint>/api/v2/plugins/marketplaces" \
  -H "Authorization: Bearer $TOKEN"

# Remove a marketplace (keep installed plugins)
curl -X DELETE "https://<agent-endpoint>/api/v2/plugins/marketplaces/my-private-marketplace" \
  -H "Authorization: Bearer $TOKEN"

# Remove a marketplace and delete its installed plugins
curl -X DELETE "https://<agent-endpoint>/api/v2/plugins/marketplaces/my-private-marketplace?deleteInstallations=true" \
  -H "Authorization: Bearer $TOKEN"

Next steps

• Install a plugin from a public marketplace for well-known public marketplaces
• Install a plugin from a URL for standalone one-off plugins
• Plugin Marketplace for marketplace formats and authoring your own