Azure DevOps
Connect Azure DevOps to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Azure DevOps to collect version control evidence with automated compliance tests, switched on per workspace.
| Category | Version Control |
| Connect with | OAuth, API token |
| What a connection produces | Automated compliance tests |
Connect with OAuth
- On Compliance › Connectors, open Azure DevOps, click Connect and choose OAuth.
- Sign in to Azure DevOps and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
499b84ac-1321-427f-aa17-267ca6975798/.default,offline_access. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In Azure DevOps:
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least an Application Developer.
- Browse to Entra ID › App registrations and select New registration.
- Enter a Name, choose Single tenant only - <your tenant> under Supported account types, leave Redirect URI empty, and select Register.
- On the app's Overview page, record the Application (client) ID.
- Select Certificates & secrets › Client secrets › New client secret, add a description, choose an expiration (24 months maximum), and select Add.
- Record the client secret Value now; it is never displayed again after you leave the page.
- In Azure DevOps, select Organization settings › Users (requires Project Collection Administrators, or a project/team admin if the invitation policy allows).
- Select Add users, enter the display name of the service principal, choose the access level and projects, then select Add. Azure Repos access needs Basic or higher; Stakeholder does not include Azure Repos.
- If Azure DevOps cannot find the principal, use the service principal's Object ID from Enterprise applications, not the ID from App registrations.
- Grant the identity only the read permissions it needs (Azure DevOps uses its own access levels and group memberships, not Entra application permissions).
Where to find the other values:
- Application (client) ID: The app registration's Overview page in Entra ID › App registrations.
Azure DevOps shows the secret only once, so copy it before you leave the page.
Source: learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.
-
On Compliance › Connectors, open Azure DevOps, click Connect, choose API token and fill in:
Field What to enter Directory (tenant) ID Required. Application (client) ID Required. Client secret Required. Stored encrypted and never shown again. Graph access token (optional) Alternative to app credentials: paste a Microsoft Graph token with Directory.Read.All. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Azure DevOps and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC2.1, CC6.1, CC6.2, CC6.3, CC7.1, CC7.3, CC7.4, CC7.5, CC8.1 | 25 |
| ISO/IEC 27001 | Automated tests | A.5.3, A.5.9, A.5.15, A.5.16, A.5.17, A.5.18, A.5.25, A.5.26, A.5.27, A.6.5, A.8.2, A.8.4, A.8.8, A.8.12, A.8.25, A.8.28, A.8.29, A.8.32 | 25 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(6), 164.312(a)(1), 164.312(c)(1) | 25 |
| PCI DSS | Automated tests | 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.6.3, 12.10.1, 12.10.6 | 25 |
| NIST CSF 2.0 | Automated tests | ID.AM-02, ID.IM-03, ID.RA-01, PR.AA-01, PR.AA-05, PR.DS-01, PR.PS-01, PR.PS-06, RS.MA-02, RS.MA-03, RS.MI-02 | 25 |
These tests are switched on per workspace by the Safeguard team.
Related
- Version Control connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks