Integrating SailPoint with Microsoft Azure DevOps

The Microsoft Azure DevOps connector provides governance capabilities for users of Azure DevOps systems. It supports aggregation, provisioning, and adding or removing entitlements at the account level.

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Microsoft Azure DevOps connector.

Supported Features

The Microsoft Azure DevOps connector supports the following features.

Account Management

• Manage Azure DevOps users as accounts.
• Aggregate and refresh accounts.
• Create account (User and Service Principal).
• Add or remove entitlements.

Entitlement Management

• Manage Azure DevOps groups as entitlements.
• Aggregate and refresh entitlements.

Prerequisites

The prerequisites on this page are required to use the Microsoft Azure DevOps connector.

Prerequisites depend on the Grant Type you configure on the Connection Settings page.

Personal Access Token

The following prerequisites apply when you use the Personal Access Token grant type:

• Create a personal access token (PAT) in the source with the proper permissions. For more information, refer to the following excerpts from the Microsoft Azure DevOps documentation:

  • Prerequisites
  • Create a PAT

  Note

  The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

When you generate the PAT, ensure it has the following scopes:

• vso.graph - Grants the ability to read user, group, scope and group membership information.
• vso.graph_manage - Grants the ability to read user, group, scope and group membership information, and to add users, groups and manage group memberships.

Client Credentials and JWT Certificate Credentials

The following prerequisites apply when you use the Client Credentials or JWT Certificate Credentials grant type:

• Create an OAuth credential (client secret or certificate) for a service principal in Microsoft Entra ID. For more information, refer to the following excerpts from the Microsoft documentation:

  • Use service principals and managed identities in Azure DevOps
  • OAuth 2.0 client credentials flow - for client secret authentication
  • Certificate credentials for application authentication - for JWT certificate authentication

  Note

  The linked document is not maintained by SailPoint and is subject to change without notice.

Registering a Microsoft Entra ID Application

1. Register an application in Microsoft Entra ID and note the Client ID.
2. For Client Credentials, create a client secret for the application.

3. For JWT Certificate Credentials, create or obtain an X.509 certificate, upload the certificate to the Microsoft Entra ID application, and prepare the matching encrypted private key and its passphrase.

   Important

   Generate and use an RSA encrypted private key. Unencrypted private keys are not supported.

4. Record the Microsoft Entra ID domain name for the tenant. For example, contoso.onmicrosoft.com.

For more information, refer to Authenticate to Azure DevOps with Microsoft Entra ID in the Microsoft Azure DevOps documentation.

Adding the Service Principal to Azure DevOps

The Microsoft Entra ID application service principal must be added as a user to the Azure DevOps organization and granted the permissions required for aggregation and provisioning. For more information, refer to Use service principals and managed identities in Azure DevOps in the Microsoft Azure DevOps documentation.

Required Permissions for Service Principals

While generating and configuring OAuth credentials, ensure the service principal is added in Azure DevOps as a user with the appropriate access level. Add the service principal to the projects and resources you want to access or manage. To access and manage Azure DevOps resources, Project Collection Administrator level access is usually required. Verify and grant the access required to perform aggregation and provisioning.

Grant the service principal the minimum Azure DevOps organization permissions required for the operations you plan to use:

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.