> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure DevOps

> Connect Microsoft Azure DevOps to Iru Compliance with Microsoft Entra ID OAuth to collect project settings, repositories, branch policies, pull requests, pipelines, permissions, and organization audit activity.

### About Microsoft Azure DevOps

Iru reads **projects**, **repositories**, **branch policies**, **pull requests**, **build and release pipelines**, **users and groups**, **service connections**, and **audit log events** from the Azure DevOps REST API. Authentication is delegated **OAuth 2.0** through **Microsoft Entra ID**, using the same **Launch OAuth Authentication** wizard as the other Microsoft Azure sources. You sign in with a work account. Iru does not ask for a personal access token. Collection is limited to the organizations and projects that account can already see. Pipeline **variable names** are collected; **secret values are not**.

### How It Works

```http theme={null}
OAuth 2.0 authorization code flow (Microsoft Entra ID)
```

Iru uses Microsoft’s OAuth 2.0 authorization code flow against Azure DevOps. After you sign in and consent in the pop-up, Iru receives a short-lived access token and renews it automatically. The requested scopes follow the Azure DevOps permission model (read access such as `vso.code`, `vso.build`, `vso.release`, `vso.graph`, and `vso.audit_log`). Do not create or paste a personal access token. The wizard will not accept one.

| Detail             | Value                          |
| ------------------ | ------------------------------ |
| **Category**       | Developer tools                |
| **Authentication** | OAuth 2.0 (Microsoft Entra ID) |

Official references: [REST API overview](https://learn.microsoft.com/en-us/rest/api/azure/devops/), [Authorize access to REST APIs with OAuth 2.0](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth).

### Prerequisites

* A **Microsoft Entra ID** account that can sign in to the Azure DevOps organization you want Iru to read (`contoso` from `https://dev.azure.com/contoso`).
* Visibility of every project you want Iru to read. OAuth is delegated, so Iru inherits that account’s project access. An account that cannot see a project returns nothing for it.
* Browser **pop-ups** allowed for the Iru site, so the Microsoft consent screen can open. Decide project scope: if branch policies are out of scope, Iru cannot verify code-review or approval controls.

### Connect Microsoft Azure DevOps to Iru

<Tabs>
  <Tab title="Azure DevOps">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to Azure DevOps">
        Sign in to `https://dev.azure.com/{your-organization}` with the **Microsoft Entra ID** account you will use in the Iru wizard (same tenant and organization you want Iru to read).
      </Step>

      <Step title="Confirm project access">
        Confirm you can open every in-scope project. Iru can only collect what this account can already access.
      </Step>

      <Step title="Allow pop-ups in your browser">
        Allow **pop-ups** for your Iru hostname so the Microsoft consent screen can open from the connector wizard.
      </Step>

      <Step title="Note multi-tenant pitfalls">
        If your company uses several Entra tenants, sign out of personal Microsoft accounts in the same browser profile, or use a private window, so the OAuth popup picks the correct work account.
      </Step>

      <Step title="Do not create a personal access token">
        Iru authenticates with OAuth 2.0. Do not paste a PAT into the wizard.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Azure DevOps**](#azure-devops) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/tI0HDLDwHj8r9Ile/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=tI0HDLDwHj8r9Ile&q=85&s=87dcef15fc17d2fb9a6e53f454e41710" alt="Left navigation: Compliance expanded, Sources selected" width="410" height="1024" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Microsoft Azure DevOps">
        Find **Microsoft Azure DevOps** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Launch OAuth Authentication">
        Select **Launch OAuth Authentication**. The wizard shows **Perform OAuth Authentication**.
      </Step>

      <Step title="Sign in and consent">
        When the Microsoft window opens, sign in with the same Entra account you verified in Azure DevOps and click **Accept** on the consent screen.
      </Step>

      <Step title="Finish the connection">
        When the OAuth window closes and Iru finishes the exchange, the wizard shows **Connection Configured**. If the wizard also asks for an **organization** name, enter the name only (for example `contoso`, not the full URL).
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Microsoft Azure DevOps** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Authentication fails or the Microsoft window never appears">
    Check **pop-up blocker** settings, then sign in with the work account for the correct Entra tenant.
  </Accordion>

  <Accordion title="Repositories appear but branch policies, pull requests, or pipelines do not">
    The signing-in account lacks read access to those objects. Sign in with an account that can see every in-scope project, or have an admin grant that access and reconnect.
  </Accordion>

  <Accordion title="A project is missing entirely">
    The account that completed OAuth cannot see that project. Reconnect with an account that has access to every in-scope project.
  </Accordion>

  <Accordion title="The card shows Broken after a period of inactivity">
    Access tokens renew while the connection is active. If refresh is interrupted, turn the source off and on, then complete OAuth again. This is not a PAT expiry. Iru does not use a personal access token for this source.
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>