> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure DevOps

> Connect Azure DevOps to RAD Security so RADBot and Automations can work with your repositories, work items, pull requests, and pipelines.

# Azure DevOps Integration Setup

This guide walks you through creating an Azure DevOps personal access token (PAT), identifying your organization, and configuring the integration in RAD Security.

[Azure DevOps](https://dev.azure.com/) provides Git repositories, work item tracking, and CI/CD pipelines. Once integrated, RADBot and Automations can read repositories, query and update work items, review and open pull requests, and inspect builds and pipelines — live, on demand.

<Info>
  This is an **AI-first** integration: it connects your Azure DevOps organization to RADBot and Automations over the official Azure DevOps MCP server. It does not continuously sync data into RAD Security — RADBot queries Azure DevOps directly when a question or automation requires it.
</Info>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * Access to an Azure DevOps organization (the `{organization}` in `https://dev.azure.com/{organization}`)
  * Permission to create a personal access token for the account RAD Security will use
  * Access to a RAD Security workspace with integration permissions
</Check>

<Info>
  **Service Account Recommended:** Create or use a dedicated Azure DevOps user for this integration rather than a personal account. Personal accounts may be removed when team members leave, which will break the integration. A PAT also inherits the permissions of the account that creates it, so a dedicated, least-privilege account keeps RADBot's access scoped.
</Info>

***

## Step 1: Choose the Account RAD Security Will Use

<Steps>
  <Step title="Use a dedicated user">
    Use (or create) a dedicated Azure DevOps user — for example a Microsoft Entra ID service account — and add it to your organization as a **Member**.
  </Step>

  <Step title="Grant project access">
    Add the user to the projects you want RADBot to work with, with the minimum access level required (for example, **Basic** with **Contributor** on the relevant repositories and work items). RADBot's reach is limited to the projects and repositories this account can see.

    <Note>
      Azure DevOps permissions are project- and repository-scoped. Grant access only to the projects relevant to your security work.
    </Note>
  </Step>
</Steps>

***

## Step 2: Create a Personal Access Token

<Steps>
  <Step title="Sign in as the service account">
    Sign in to `https://dev.azure.com/{organization}` as the account from Step 1.
  </Step>

  <Step title="Open Personal Access Tokens">
    1. Click the **User settings** icon (top right, next to your avatar)
    2. Select **Personal access tokens**
    3. Click **+ New Token**
  </Step>

  <Step title="Configure the token">
    1. **Name**: a descriptive name, e.g. `RAD Security`
    2. **Organization**: select the organization you want to connect
    3. **Expiration**: set an expiration that matches your security policy (Azure DevOps PATs cannot be set to never expire on most organizations)
  </Step>

  <Step title="Select scopes">
    Grant the scopes that match the capabilities you want RADBot to have. For full read + write access, select:

    | Scope                | Access       | Enables                                                                 |
    | -------------------- | ------------ | ----------------------------------------------------------------------- |
    | **Code**             | Read & write | Browse repos, files, and branches; read and create/update pull requests |
    | **Work Items**       | Read & write | Query work items; create, update, and comment on them                   |
    | **Build**            | Read         | List builds and pipelines                                               |
    | **Project and Team** | Read         | List projects (also used to verify the connection)                      |

    <Note>
      To give RADBot **read-only** access, select the **Read** variants of these scopes instead. The integration exposes write actions, but Azure DevOps will reject them if the PAT lacks write scopes — the PAT is your security boundary.
    </Note>
  </Step>

  <Step title="Create and copy the token">
    Click **Create**, then immediately copy the token.

    <Warning>
      Azure DevOps shows the token value only once. Copy it now — you cannot retrieve it later.
    </Warning>
  </Step>
</Steps>

***

## Step 3: Configure in RAD Security

In your RAD Security workspace, navigate to **Data Sources → Integrations**, select **Azure DevOps**, and enter:

| Parameter                        | Description                                                                                                  | Example               |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------ | --------------------- |
| **Organization**                 | Your Azure DevOps organization name — the `{organization}` segment in `https://dev.azure.com/{organization}` | `contoso`             |
| **Personal Access Token**        | The PAT generated in Step 2                                                                                  | `xxxxxxxxxxxxxxxx...` |
| **Default Project** *(optional)* | A default project to scope operations to when one is not specified                                           | `Platform`            |

<Note>
  The **Organization** is just the org name, not a full URL. The integration calls `https://dev.azure.com/<organization>/_apis/projects` to verify the organization and token.
</Note>

Click **Verify** to test the credentials. When verification succeeds, save the integration.

***

## Verify Integration

<Steps>
  <Step title="Open the integration">
    Navigate to **Data Sources → Integrations → Engineering** and locate your **Azure DevOps** integration.
  </Step>

  <Step title="Check the status">
    Confirm the connection status shows as **Connected**.
  </Step>

  <Step title="Try it in RADBot">
    Ask RADBot something that requires Azure DevOps, for example: *"List the open pull requests in the Platform project."*
  </Step>
</Steps>

<Check>
  Your Azure DevOps integration is now configured. RADBot and Automations can work with your repositories, work items, pull requests, and pipelines.
</Check>

***

## What RADBot Can Do

The exact actions available are the intersection of these capabilities and the scopes granted to your PAT.

<AccordionGroup>
  <Accordion title="Repositories & Pull Requests" icon="code-branch">
    * List repositories and branches
    * Read file and directory contents
    * List pull requests
    * Create and update pull requests *(requires Code write scope)*
  </Accordion>

  <Accordion title="Work Items" icon="list-check">
    * Query and read work items
    * Create and update work items *(requires Work Items write scope)*
    * Add comments to work items *(requires Work Items write scope)*
  </Accordion>

  <Accordion title="Pipelines & Builds" icon="gears">
    * List pipelines in a project
    * List builds and inspect their status
  </Accordion>

  <Accordion title="Search & Discovery" icon="magnifying-glass">
    * List projects
    * Search code across repositories
  </Accordion>
</AccordionGroup>

***

## Use Cases

<CardGroup cols={2}>
  <Card title="Investigate with Live Context" icon="robot">
    Let RADBot read repositories, pull requests, and work items while investigating an incident.
  </Card>

  <Card title="Automated Work Items" icon="wand-magic-sparkles">
    Use Automations to create or update Azure DevOps work items from high-severity findings.
  </Card>

  <Card title="Code Search" icon="magnifying-glass">
    Search code across repositories for security anti-patterns, secrets, or vulnerable constructs.
  </Card>

  <Card title="Pipeline Visibility" icon="gears">
    Ask RADBot about recent builds and pipeline status when triaging delivery risk.
  </Card>
</CardGroup>

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Verification fails — invalid or expired token" icon="triangle-exclamation">
    **Possible causes:**

    * The PAT is incorrect, was revoked, or has expired
    * The token was copied with extra whitespace

    **Solution:**

    * Sign in as the service account and confirm the token under **User settings → Personal access tokens**
    * Re-generate the PAT if it expired or was revoked, and update the **Personal Access Token** field in RAD Security

    <Note>
      Azure DevOps sometimes returns a sign-in page (HTTP 203) instead of a 401 for an invalid token. RAD Security treats this as an invalid or expired token.
    </Note>
  </Accordion>

  <Accordion title="Verification fails — organization not found" icon="building-circle-xmark">
    **Possible causes:**

    * The **Organization** value is wrong, or a full URL was entered instead of just the org name

    **Solution:**

    * Enter only the organization name — the `{organization}` in `https://dev.azure.com/{organization}` (e.g. `contoso`, not `https://dev.azure.com/contoso`)
  </Accordion>

  <Accordion title="RADBot can read but write actions fail" icon="shield-exclamation">
    **Possible causes:**

    * The PAT was created with read-only scopes
    * The service account lacks permission to write to the target project or repository

    **Solution:**

    * Re-generate the PAT with **Code (Read & write)** and **Work Items (Read & write)** scopes
    * Confirm the service account has Contributor access to the relevant projects
  </Accordion>

  <Accordion title="A project or repository is not visible to RADBot" icon="folder-xmark">
    **Possible causes:**

    * The service account does not have access to that project or repository

    **Solution:**

    * Grant the service account access to the project in Azure DevOps, then try again
  </Accordion>

  <Accordion title="Rotating the Personal Access Token" icon="rotate">
    1. Sign in as the service account and create a new PAT with the same scopes
    2. Update the **Personal Access Token** field on the RAD Security integration
    3. Save — RAD Security re-verifies on save
    4. Revoke the old PAT in Azure DevOps
  </Accordion>
</AccordionGroup>

***

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use a Service Account" icon="user-gear">
    Never use a personal account. Use a dedicated Azure DevOps user so access survives staff changes and stays auditable.
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Grant the smallest set of scopes and project access RADBot needs. Use read-only scopes if you do not want write actions.
  </Card>

  <Card title="Set Token Expiration" icon="clock">
    Give the PAT an expiration that matches your security policy, and rotate it before it expires.
  </Card>

  <Card title="Audit Activity" icon="clipboard-list">
    Periodically review work items and pull requests created by the service account to detect unexpected behavior.
  </Card>
</CardGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Engineering Integrations Overview" icon="code-branch" href="/rad-security/integrations/engineering/overview">
    Learn about other engineering integrations
  </Card>

  <Card title="RADBot" icon="robot" href="/rad-security/getting-started/radbot">
    Learn how RADBot uses your integrations during investigations
  </Card>

  <Card title="Data Sources" icon="database" href="/rad-security/integrations/data-sources">
    Explore all available data sources
  </Card>
</CardGroup>