Azure DevOps connector setup

This page is the setup half — registering the Microsoft Entra ID app Azure DevOps sign-in needs and getting its client id and secret into this deployment. Authorising a connection afterwards is the Authenticate control on the plugin sheet, which is what actually sends you to Microsoft.

The connector is read-only: organisations, repositories, pull requests and work items. It signs in with Microsoft Entra ID, because Azure DevOps' own OAuth takes no new apps and is removed in 2026. Work or school accounts in an Entra-backed organisation only; personal Microsoft accounts are not supported for the Azure DevOps resource. The vendor facts behind this page are in docs/research/connectors/azure-devops.md.

1. Register the app in Microsoft Entra ID

1. In the Microsoft Entra admin center, open App registrations and register a new app. This is your own app, not Botseon's. For members from several tenants, pick accounts in any organisational directory.

2. Add a Web redirect URI: the redirect URL from docs/connectors/README.md — with the quickstart's default BOTSEON_PUBLIC_URL, that is:

   http://127.0.0.1:3000/api/oauth/azure-devops/callback
   

3. Under Certificates & secrets, add a client secret and copy it now, with the app's Application (client) ID.

4. Under API permissions, add Azure DevOps → Delegated → vso.code, vso.work and vso.profile. If your tenant restricts user consent, an administrator grants it here.

2. Scopes

The sign-in asks for Azure DevOps' three read scopes and offline_access (for a refresh token): 499b84ac-1321-427f-aa17-267ca6975798/vso.code, …/vso.work, …/vso.profile. The account is recorded as holding azure-devops:all; the connector has no write tool. Nothing needs switching on in Azure DevOps itself — its "Third-party application access via OAuth" policy governs only its own retired OAuth apps.

3. Enter the app

One command, with the client secret on standard input (see docs/connectors/README.md):

printf %s "$CLIENT_SECRET" | botseon oauth-app set \
  --org <organisation id> --slug azure-devops \
  --client-id <the application (client) ID from step 1> \
  --auth-url https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize \
  --token-url https://login.microsoftonline.com/organizations/oauth2/v2.0/token \
  --configured-by <your user id>

It stores the secret encrypted and prints the redirect URL from step 1 back, so you can check the two match. botseon oauth-app show --org <organisation id> --slug azure-devops says whether an app is configured and under which client id; nothing prints the secret back.

Never put either value in a bot's description, a memory, or anywhere else a model reads as ordinary text.