About Microsoft Azure DevOps
Iru reads projects, repositories, branch policies, pull requests, build and release pipelines, users and groups, service connections, and audit log events from the Azure DevOps REST API. Authentication is delegated OAuth 2.0 through Microsoft Entra ID, using the same Launch OAuth Authentication wizard as the other Microsoft Azure sources. You sign in with a work account. Iru does not ask for a personal access token. Collection is limited to the organizations and projects that account can already see. Pipeline variable names are collected; secret values are not.How It Works
vso.code, vso.build, vso.release, vso.graph, and vso.audit_log). Do not create or paste a personal access token. The wizard will not accept one.
Official references: REST API overview, Authorize access to REST APIs with OAuth 2.0.
Prerequisites
- A Microsoft Entra ID account that can sign in to the Azure DevOps organization you want Iru to read (
contosofromhttps://dev.azure.com/contoso). - Visibility of every project you want Iru to read. OAuth is delegated, so Iru inherits that account’s project access. An account that cannot see a project returns nothing for it.
- Browser pop-ups allowed for the Iru site, so the Microsoft consent screen can open. Decide project scope: if branch policies are out of scope, Iru cannot verify code-review or approval controls.
Connect Microsoft Azure DevOps to Iru
- Azure DevOps
- Iru Compliance
Complete this tab before you connect the source in Compliance.
1
Sign in to Azure DevOps
Sign in to
https://dev.azure.com/{your-organization} with the Microsoft Entra ID account you will use in the Iru wizard (same tenant and organization you want Iru to read).2
Confirm project access
Confirm you can open every in-scope project. Iru can only collect what this account can already access.
3
Allow pop-ups in your browser
Allow pop-ups for your Iru hostname so the Microsoft consent screen can open from the connector wizard.
4
Note multi-tenant pitfalls
If your company uses several Entra tenants, sign out of personal Microsoft accounts in the same browser profile, or use a private window, so the OAuth popup picks the correct work account.
5
Do not create a personal access token
Iru authenticates with OAuth 2.0. Do not paste a PAT into the wizard.
Continue on the Iru Compliance tab.
Troubleshooting
Nothing opens when you turn the source on
Nothing opens when you turn the source on
Check pop-up blocker settings for the Iru site and try again.
Authentication fails or the Microsoft window never appears
Authentication fails or the Microsoft window never appears
Check pop-up blocker settings, then sign in with the work account for the correct Entra tenant.
Repositories appear but branch policies, pull requests, or pipelines do not
Repositories appear but branch policies, pull requests, or pipelines do not
The signing-in account lacks read access to those objects. Sign in with an account that can see every in-scope project, or have an admin grant that access and reconnect.
A project is missing entirely
A project is missing entirely
The account that completed OAuth cannot see that project. Reconnect with an account that has access to every in-scope project.
The card shows Broken after a period of inactivity
The card shows Broken after a period of inactivity
Access tokens renew while the connection is active. If refresh is interrupted, turn the source off and on, then complete OAuth again. This is not a PAT expiry. Iru does not use a personal access token for this source.
Related Articles
Sources Management
Browse and manage every Compliance source.
Getting Started With Compliance
Frameworks, actions, and Artifacts.
Iru Overview
How Endpoint, Compliance, and Identity fit together.
Artifacts Management
Upload, review, and organize evidence from sources and actions.