Skip to main content

Connect an ADO Repository with Managed Identity

What you'll build

An Azure DevOps repository connection authenticated with managed identity - no PATs to create or rotate. Your agent uses its own Azure identity to access ADO repos for code-aware investigations. Includes optional FIC setup for cross-tenant access.

Prerequisites​

  • An agent created in the Azure SRE Agent portal in Running state
  • A managed identity enabled on your agent (system-assigned or user-assigned)
  • An Azure DevOps organization with at least one repository
  • SRE Agent Administrator role on the agent
  • For cross-tenant (FIC): A multi-tenant app registration in the agent's tenant with a federated identity credential trusting the agent's managed identity

Step 1: Grant the managed identity access to your ADO organization​

Before connecting from the agent portal, your managed identity must have access to the Azure DevOps organization.

  1. Go to your Azure DevOps organization settings and select your organization
  2. Navigate to Organization settings -> Users
  3. Click Add users
  4. Search for your agent's managed identity by its service principal name or object ID
  5. Set the access level to Basic (or higher)
  6. Add the identity to projects with Code (Read) permissions on the target repositories
Project-level read permission required

Without project-level read permission, the agent will not be able to detect repositories in the Knowledge tab. Ensure you grant both project-level AND repository-level access.

Checkpoint: The managed identity appears in the ADO Users list with a Basic access level.

Step 2: Navigate to Knowledge sources​

  1. Open your agent in the Azure SRE Agent portal
  2. In the left sidebar, expand Builder
  3. Select Knowledge sources

Checkpoint: The Knowledge Sources page loads showing any existing repository connections.

Step 3: Open the Add Repository dialog​

  1. Click Add repository

Checkpoint: The Add repositories dialog opens showing platform selection cards (GitHub, Azure DevOps).

Step 4: Select Azure DevOps with Managed Identity​

  1. Click the Azure DevOps platform card
  2. Under Choose sign in methods, select Managed Identity

Checkpoint: The managed identity configuration form appears with an organization field and identity dropdown.

Step 5: Configure the managed identity connection​

  1. Enter your Azure DevOps Organization name - the part after dev.azure.com/ in your ADO URL
  2. From the managed identity dropdown, select your identity:
    • System assigned - uses the agent's built-in identity
    • User assigned - select a specific identity attached to the agent
  3. Click Connect

Checkpoint: The button changes to Connected with a checkmark, confirming the managed identity is configured.

Identity not showing?

If the dropdown is empty, your agent may not have a managed identity enabled. Click the Add identity link below the dropdown to open the Azure portal Identity blade for your agent resource.

Step 6 (optional): Enable Federated Identity Credentials for cross-tenant access​

Microsoft internal teams

FIC is the recommended pattern when the agent's tenant differs from the ADO organization's tenant. See the Cross-Tenant ADO Access tutorial for the end-to-end multi-tenant app + service principal + FIC walkthrough.

If your ADO organization is in a different Azure AD tenant than your agent:

  1. Check Use managed identity as federated identity credential
  2. Enter the Federated Client ID - the application (client) ID of the multi-tenant app registration (created in the agent's tenant)
  3. Enter the Federated Tenant ID - the directory (tenant) ID where that app registration lives (the agent's tenant)
  4. Click Connect

Prerequisites for FIC (complete these before Step 6):

  1. Create a multi-tenant app registration in the agent's tenant
  2. Add a federated identity credential on that app registration:
    • Issuer: Your agent's managed identity issuer URL (https://login.microsoftonline.com/<AGENT_TENANT_ID>/v2.0)
    • Subject identifier: Your MI's Object (principal) ID
    • Audience: api://AzureADTokenExchange
  3. Materialize a service principal for that app in the target (ADO) tenant (az ad sp create --id <app-client-id> after az login --tenant <ADO-tenant-id>)
  4. Grant that service principal access to the ADO organization, project, and repo (see Cross-Tenant ADO Access tutorial for detailed steps)

Checkpoint: The FIC configuration saves successfully and the button shows Connected.

Step 7: Advance to repository selection​

  1. Click Next to proceed to the repository selection step

Checkpoint: The dialog advances to show a project picker and repository grid.

Step 8: Select a project and add repositories​

  1. From the Azure DevOps Project dropdown, select the project containing your repositories
  2. Click Add to add a repository row
  3. From the Repository dropdown, select a repository from the project (repositories are sorted alphabetically)
  4. Enter a Display name for the repository
  5. Optionally enter a Description
  6. Repeat for additional repositories
  7. Click Save

Checkpoint: Selected repositories appear in the Knowledge Sources page.

Troubleshooting​

ProblemCauseFix
Identity dropdown is emptyAgent has no managed identity enabledEnable a system-assigned identity or attach a user-assigned identity in the Azure portal
Connect button failsOrganization name is missingEnter the ADO organization name before connecting
Repos don't load after connectingMI doesn't have access to the ADO organizationAdd the MI service principal as a user in ADO Organization Settings -> Users
No repositories found in project pickerMI has org-level access but missing project-level genericReadGrant project-level read permissions to the service principal
FIC connection failsFederatedClientId and FederatedTenantId not both providedBoth fields are required when using FIC - provide both or neither
FIC token exchange failsFederated credential not configured on the agent-tenant app registrationVerify the multi-tenant app registration in the agent's tenant has a federated identity credential with the correct issuer and subject

What you learned​

  • How to grant a managed identity access to an Azure DevOps organization
  • How to connect ADO repositories using managed identity instead of PATs
  • The difference between system assigned and user assigned identities
  • How to configure FIC for cross-tenant repository access

Next steps​

Last updated on
Was this page helpful?
Report an issue with this page