Set Up Azure DevOps Connector
Azure DevOps authentication is configured per organization on the Context > Code access page. It is not offered in the Builder > Connectors add-connector wizard.
An authenticated connection to your Azure DevOps organization so your agent can read repositories, wikis, and work items during investigations. Sign in with your account for automatic token management, use a managed identity for unattended access, or use a PAT for service account scenarios.
Prerequisites
- An agent created in the Azure SRE Agent portal
- An Azure AD account with access to your Azure DevOps organization
- SRE Agent Administrator or Standard User role on the agent
Step 1: Open Code access
- Open your agent in the Azure SRE Agent portal
- In the left sidebar, expand Context and select Code access
- Select the Azure DevOps tab
- Click Add repository
The Add repositories dialog opens on the Connection step with Azure DevOps selected.
The Builder > Connectors add-connector wizard does not list an Azure DevOps OAuth card. Azure DevOps repository authentication was moved to Code access.
Step 2: Enter your organization
In Organization, enter your Azure DevOps organization name — the part after dev.azure.com/ in your URL. For example, if your URL is https://dev.azure.com/contoso, enter contoso.
The organization name must:
- Start and end with a letter or digit
- Contain only letters, numbers, and hyphens
- Be up to 50 characters long
Once the organization name is valid, the Sign In Methods options appear.
Azure DevOps connections are configured per organization. To give your agent access to multiple organizations, repeat these steps for each one.
Step 3: Choose a sign-in method
| Method | Best for | Token lifecycle |
|---|---|---|
| Your account | Quick setup with your Azure AD identity | Auto-refreshes — no manual renewal |
| Managed Identity | Unattended production agents | Managed by Azure — no secret to rotate |
| PAT | Service accounts or organizations that standardize on PATs | Expires per your PAT policy — rotate manually |
Your account (OAuth)
- Select Your account
- Click Sign in to Azure DevOps
- An Authorize Azure DevOps dialog lists the permissions your agent needs:
- Read and write access to repositories and projects
- Act on behalf of the signed-in user
- Click Authorize
Checkpoint: A Connected as card shows Connected to Azure DevOps. If you see an error instead, check that your Azure AD account has access to the organization.
Click Sign in with a different account to re-authenticate with a different identity.
Managed Identity
- Select Managed Identity
- In Managed identity, select System assigned or one of the agent's user-assigned identities. To assign a new identity to the agent, click Add identity, then use the refresh button to reload the list.
- If the connection uses a federated identity credential, select Use managed identity as federated identity credential and enter the Federated client ID and Federated tenant ID. When your agent's tenant requires a federated identity credential, this option is already selected and can't be cleared.
- Click Connect
Checkpoint: A Connected as card shows Managed Identity.
For same-tenant access, the managed identity must be added as a user in your Azure DevOps organization, with access to the repositories you want to connect. For cross-tenant FIC, grant the app registration's App ID instead — see Enable Federated Identity Credentials. Choose managed identity when your agent runs unattended, such as in automated workflows or scheduled tasks.
PAT
- Select PAT
- Paste your token into Provide PAT. The token needs at least the Code (Read) (
vso.code) scope. To let the agent create pull requests, grant Code (Read & write) (vso.code_write) instead. - Click Connect
Don't have a PAT? After you enter the organization, click Get PAT to open your organization's token page.
Checkpoint: A Connected as card shows PAT. Connect validates the token against your organization and saves it right away.
Step 4: Add repositories and save
- Click Next to open the Add repositories step
- Select a project from Azure DevOps Project
- In Repository URL, select a repository from the list or type its URL. Display name fills in automatically.
- To add more repositories, click Add
- Click Save
Your organization now appears on the Azure DevOps tab of Code access with a Connected status and the repositories you added.
Step 5: Verify access
Test that your agent can access your Azure DevOps repositories.
Ask your agent:
What repositories are available in my Azure DevOps organization?
Or, for a specific check:
Show me recent commits in the payment-service repository.
If your agent returns repository information, your connection is working. If it can't reach your repositories, check the connection's status on Code access and see Troubleshooting.
Step 6: Try creating a pull request (preview)
With your Azure DevOps connection active, your agent can create pull requests directly from chat.
- Open a chat thread with your agent
- Type: "Open a pull request in https://dev.azure.com/my-org/my-project/_git/my-repo from feature/fix to main titled 'Update retry logic'"
- In Review mode, click Continue to approve the PR creation
Checkpoint: You should see a tool card with a clickable link to the created PR in Azure DevOps.
Create pull requests requires Review or Autonomous run mode. The source branch must already exist with your changes committed. PAT connections need the Code (Read & write) scope.
Edit or remove a connection
Each connected organization appears as a card on the Azure DevOps tab of Code access.
Edit authentication
- On the organization's card, click Edit auth (shown as Re-auth when the token has expired or the connection has an error)
- In Edit Azure DevOps authentication, choose a sign-in method and reconnect
Disconnect
- On the organization's card, click Disconnect
- Confirm in the Disconnect authentication dialog
After you disconnect, the agent can no longer access repositories through that organization's authentication.
Remove a repository
- On the organization's card, click the delete icon on the repository row
- Click Delete to confirm
What you learned
- Azure DevOps authentication is configured per organization on Code access, not in the Connectors wizard
- How to connect with your account (OAuth), a managed identity, or a PAT
- The minimum PAT scope your agent needs
- How to add repositories and verify that your agent can access them
- How to create pull requests in Azure DevOps repos directly from chat
- How to edit, disconnect, or remove repositories from a connection
Troubleshooting
| Issue | Solution |
|---|---|
| No Azure DevOps OAuth option in Builder > Connectors | Azure DevOps authentication lives on Context > Code access. Follow Step 1 |
| Sign In Methods options don't appear | Enter a valid organization name. The options appear once the name passes validation |
| Connect is disabled | For PAT, paste a token. For managed identity, select an identity and complete any federated identity credential fields |
| "Authorize Azure DevOps" dialog doesn't appear | Refresh the page and try again. If your Azure AD session expired, sign in again at the portal |
| "Invalid or expired token" | Your Azure AD session has expired. Refresh the portal page to get a new session, then try signing in again |
| "Azure DevOps returned HTTP 404 for organization '...'" | Check that you entered the organization, not the project — it's the first path segment after dev.azure.com. If the name is correct, grant the account or identity access to the organization |
| "Azure DevOps rejected the credential (HTTP 401)" or "(HTTP 403)" | The PAT is revoked or expired, or it's missing the Code (Read) scope. For managed identity, add the identity to the organization |
| "Managed identity is unavailable until the agent tenant is resolved" | Click the refresh button next to Managed identity. If the message persists, close and reopen the dialog |
| Connection card shows Token expired or Error | Click Re-auth and sign in again, or provide a new PAT |
Related
| Resource | What you'll learn |
|---|---|
| Connect source code | Connect Azure DevOps repositories as knowledge sources |