Azure DevOps
Connect Azure Repos in an Azure DevOps organization to Safeguard. The personal access token scopes Safeguard needs, which token types work, service hooks, and step-by-step setup.
Availability
This integration is switched on per workspace. If you do not see the card under Integrations, ask your Safeguard contact.
What it does
The Azure DevOps card connects Safeguard to Azure Repos Git repositories in an Azure DevOps Services organization (dev.azure.com). Safeguard lists the projects and repositories a token can see, and each repository you select (at a branch or tag) becomes a project that Safeguard clones and scans for an SBOM and findings. With write access, Safeguard can also open fix and upgrade pull requests, comment on pull requests and set statuses. Optional service hooks rescan on push and start a pull request review when a pull request is opened or updated. Find the card under Integrations on the Project/Product tab.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | Each repository's URL, like https://dev.azure.com/<organization>/<project>/_git/<repository> | The organization URL and a personal access token |
| Credential needed | None, if the organization allows public projects | A personal access token created for that organization |
| What you can scan | Repositories in public projects that you add by URL | Every repository the token can read in the organization |
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Personal Access Token, scoped to one organization | All private connections today | Create it for the organization you connect, with only the scopes below |
| Microsoft account (Microsoft Entra ID sign-in) | Not available yet | The dialog shows it as Not set up. It needs a Microsoft Entra ID app registration on Safeguard's side |
| None (Public tab) | Public projects only | Nothing to create |
Azure DevOps Server (self-hosted, https://<server>/tfs/<collection>) is not supported yet. Only Azure DevOps Services can be connected.
Permissions required
For scanning, Safeguard only reads. It writes to Azure DevOps only for the optional features marked below, and only when you use them. The scopes below use the names the dialog shows; Azure DevOps lists them under the same areas when you create the token.
Personal Access Token
| Scope | Required? | What Safeguard uses it for |
|---|---|---|
| Code (Read) | Required | Listing repositories, branches and tags, reading files, and cloning the repository for the scan |
| Project and Team (Read) | Required | Listing the organization's projects in the Project picker |
| Code (Read & write) | Optional | Fix and upgrade pull requests (pushing the branch, committing files, opening the pull request), pull request comments and review comments, statuses, and completing a pull request from Safeguard. It includes Code (Read) |
| Code (Status) | Optional | Statuses only, if you do not want to grant Code (Read & write) |
| Service Hooks (Read, write & manage) | Optional | Creating the push and pull request service hooks for you when you click Set up webhooks. Without it, the panel shows the steps to add them yourself |
| User Profile (Read) | Not needed | Type the organization URL instead |
The account that owns the token also needs the matching Azure DevOps permissions: read access to the repositories, Contribute on a repository for fix pull requests, and membership in Project Administrators (or Project Collection Administrators) for Safeguard to create service hooks. A token never grants more than its owner has.
Least privilege: an organization-scoped token with Code (Read) and Project and Team (Read).
Token types
| Token type | Works? | Notes |
|---|---|---|
| Personal access token for one organization | Yes (recommended) | Pick the organization you connect when you create it |
| Personal access token for "All accessible organizations" (global) | Not recommended | Microsoft is retiring global tokens: they stop working on December 1, 2026. Create an organization-scoped token instead |
| Full access token | Works, not recommended | Safeguard never uses the extra scopes, and your administrator may block full-scoped tokens |
| Microsoft Entra ID sign-in | Not available yet | |
| Service principal or managed identity | Not available yet | The dialog takes a personal access token only |
| Azure DevOps Server token | No | Azure DevOps Server is not supported yet |
Expiry: set the shortest lifetime that suits you, such as 90 days; your organization's policy may set a maximum. Azure DevOps emails you before a token expires. In an organization backed by Microsoft Entra ID, a token also becomes inactive if its owner does not sign in to Azure DevOps for 90 days.
What we never need: Code (read, write, and manage) or Code (full), Build, Release, Work Items, Packaging, Identity, Graph, Security or any administrative scope.
Step-by-step setup
Create the credential in Azure DevOps
- Sign in to
https://dev.azure.com/<organization>. - Open User settings and select Personal access tokens.
- Select + New Token.
- Enter a name, select your organization (not "All accessible organizations"), and set an expiration date.
- Select only these scopes: Code (Read) and Project and Team (Read). Add Code (Read & write) for fix pull requests, and Service Hooks for automatic webhook setup.
- Select Create and copy the token. Azure DevOps does not show it again.
Or with the command line
Azure DevOps creates tokens in the page above, or through its PAT Lifecycle Management API with a Microsoft Entra token. To check a token the way Safeguard does:
# Is the token accepted for this organization?
curl -s -u ":${AZURE_DEVOPS_PAT}" "https://dev.azure.com/<organization>/_apis/connectionData"
# Project and Team (Read)
curl -s -u ":${AZURE_DEVOPS_PAT}" "https://dev.azure.com/<organization>/_apis/projects?api-version=7.1"
# Code (Read)
curl -s -u ":${AZURE_DEVOPS_PAT}" "https://dev.azure.com/<organization>/_apis/git/repositories?api-version=7.1"Connect it in Safeguard
- Open Integrations and choose the Project/Product tab.
- Click Connect on the Azure DevOps card.
- For public projects, stay on Public, enter a Name and add each repository URL. Then click Next.
- For private repositories, choose Private and enter a Name (and an optional Description).
- Under Sign in with, keep Personal Access Token.
- Enter the Organization URL, for example
https://dev.azure.com/contoso(a legacyhttps://contoso.visualstudio.comaddress works too). - Paste the token into Personal Access Token and click Check access. "Signed in as ...; ... repositories visible" means the token works. A warning about Code (Read & write) means scanning works but fix pull requests will not open.
- Click Next. Choose a Project (or All projects), select the repositories and the branch or tag of each, and finish with the Connect button (fast, deep or progressive scan).
Webhooks and triggers
Each selected repository is scanned when you connect it, and you can set a schedule under Integrations > Scheduled. Optional service hooks add two triggers:
- Code pushed: a push to the branch Safeguard scans starts a rescan of that repository.
- Pull request created and Pull request updated: an active pull request starts a Safeguard pull request review (and the code analysis gate where you turned it on).
To set them up, open the connection's menu under Project Configurations, choose Update, and in Scan on push and pull requests click Set up webhooks. Webhooks need a private connection.
- If the token has the Service Hooks scope and its account may manage the project's service hooks, Safeguard creates three subscriptions for each selected repository and the panel says "Service hooks created in Azure DevOps".
- Otherwise the panel shows the details to add them yourself. In Azure DevOps, open Project settings > Service hooks, select Create subscription, choose Web Hooks and Next, and create one subscription for each of Code pushed, Pull request created and Pull request updated (choose "Source branch updated" as the change). On the Action screen enter the URL from the panel (
https://api.safeguard.sh/scm/api/v1/integrations/azure-devops/webhooks/<connection id>), the basic authentication username from the panel and the Password shown there, set Resource details to send to All and Messages to send to None, then Test and Finish.
The password is shown only once. Set up again (new secret) replaces it and removes the old subscriptions; Remove webhooks deletes them. Deliveries without the right username and password are refused.
What we read and store
- Read: the token's account, the organization's projects and repositories, branches and tags, and the contents of each selected repository at the chosen branch or tag. For pull request features, the pull request, its changes and its comment threads. From service hooks, the push or pull request event.
- Stored: the connection's settings and organization, the repositories you selected, the SBOM and findings of each scan, the service hook subscription ids, and the token and webhook secret, which are encrypted at rest with a per-workspace key and never shown again after you save them.
- Not stored: source code. The scanner makes a shallow clone into a temporary folder and deletes it when the scan ends.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Azure DevOps did not accept the Personal Access Token for organization <org>. It may be revoked, mistyped or created for a different organization. | The token is wrong, revoked, or was created for another organization | Create a token for this organization |
The Personal Access Token is missing the Project and Team (Read) scope. ... | The token cannot list projects | Edit the token in User settings > Personal access tokens and add Project and Team (Read) |
The Personal Access Token is missing the Code (Read) scope. ... | The token cannot list repositories | Add Code (Read), or Code (Read & write) for fix pull requests |
The token is missing the Code (Read & write) scope (or write permission on the repository). Scanning works, but ... | A warning: the token can read but not write | Add Code (Read & write) and give the account Contribute on the repository, if you want fix pull requests |
The Personal Access Token has expired. ... | The token's expiration date passed | Create a new token and update the connection |
Organization <org> was not found. ... | The organization URL is wrong | Copy it from your browser: https://dev.azure.com/<organization> |
Azure DevOps Server (self-hosted, /tfs/...) is not supported yet. ... | A /tfs/ server address was entered | Only Azure DevOps Services can be connected |
Azure DevOps asked for sign-in to ... The project is not public, or the organization does not allow public projects. ... | A private project was added on the Public tab | Connect it on the Private tab with a token |
Safeguard could not create the service hooks itself: ... | The token lacks the Service Hooks scope, or the account cannot manage service hooks | Add the scope or the permission, or create the hooks by hand from the steps shown |
Azure DevOps is rate-limiting this account. ... | Azure DevOps throttled the requests | Wait the time shown and try again |
Rotation and disconnect
- Rotate: create a new organization-scoped token with the same scopes (or regenerate the old one in Azure DevOps, which invalidates its old value). Under Project Configurations on the Project/Product tab, open the connection's menu, choose Update, paste the token into Personal Access Token, click Check access, and click Save. Then revoke the old token in User settings > Personal access tokens.
- Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration. Deleting the connection removes its service hooks and the stored token. Then revoke the token in Azure DevOps (select it and choose Revoke).
Vendor references
- Use personal access tokens, checked 2026-10-16.
- OAuth 2.0 scopes for Azure DevOps REST APIs, checked 2026-10-16.
- Webhooks with Azure DevOps, checked 2026-10-16.
- Retirement of global personal access tokens in Azure DevOps, checked 2026-10-16.
Bitbucket
Connect Bitbucket Cloud repositories to Safeguard. The API token scopes Safeguard needs, which Bitbucket credentials work, and step-by-step setup.
Azure DevOps TFVC
Scan Team Foundation Version Control (TFVC) folders through your Azure DevOps connection. Which projects to name, the token scopes, polling and the Code checked in service hook, and why fixes arrive as patches.