Azure DevOps Integration

Introduction

The Conviso Platform integration with Azure DevOps allows you to connect your Azure DevOps organizations and repositories to the platform. Once connected, you can import repositories as assets and manage them in a single place for security scanning and vulnerability management.

The setup has two steps: Connect to Azure DevOps and Authorize access (organizations and repositories). After that, the Azure DevOps page shows what Conviso can access, and the scans are set up in Scan Setup.

Authentication modes

On Connect to Azure DevOps you choose how Conviso authenticates with Azure DevOps:

Mode	Summary
OAuth (this guide)	A Microsoft / Entra user signs in and consents. Organizations are listed from that user’s membership.
Service Principal	Your own Entra app registration + client secret. Organizations are typed by name. See Azure DevOps Service Principal.

Objective

By the end of this guide (OAuth), you will have:

• Connected your Azure DevOps account to Conviso Platform via Microsoft Entra ID.
• Selected which organizations and repositories to authorize.
• Viewed the list of integrated assets (repositories imported as assets).

Prerequisites

This integration is supported only for Azure DevOps Services (cloud); for Azure DevOps Server (self-hosted / on-premises, formerly TFS) instances, use the Azure Pipelines integration instead.

Before you start with OAuth, ensure that:

• You can authorize the Conviso Platform application in the Microsoft consent screen (grant OAuth permissions) and you have access to the Azure DevOps organization(s) you want to connect. If your organization restricts who can install or authorize apps, an Entra ID or Azure DevOps administrator may need to approve the app first.
• You have a Microsoft account (or Microsoft Entra ID account) with access to the Azure DevOps organizations you want to connect.
• Your Conviso Platform company has the integration feature available (contact your administrator if the Azure DevOps card does not appear).
• The same Microsoft account used to connect must have Edit subscriptions and View subscriptions on each Azure DevOps project whose repositories you import. Conviso registers Service Hooks on those projects so new repositories, pull requests, and merges can notify the platform. See Service hook permissions.

For Service Principal prerequisites (Entra app registration, client secret, and adding the principal to each Azure DevOps organization), follow Azure DevOps Service Principal instead.

info

The first time you connect with OAuth, an administrator may need to register the Conviso Platform application in your Azure DevOps / Microsoft Entra ID tenant and configure the OAuth client. If you do not see the "Connect to Azure DevOps" option or the consent screen, contact your Conviso or Azure DevOps administrator.

Steps

Step 1 – Locate the Azure DevOps integration

1. In the Conviso Platform sidebar, click Integrations.
2. On the Integrations page, use the category filter if needed (e.g. Application Lifecycle Management).
3. Locate the Azure DevOps card and click Connect.

Step 1: Integrations page with Azure DevOps and Connect button.

---

Step 2 – Connect to Azure DevOps (Login)

1. On the Azure DevOps integration page, you will see two cards: Connect to Azure DevOps and Authorize access.
2. On Connect to Azure DevOps, under Authentication, keep OAuth selected (for Service Principal, see Azure DevOps Service Principal).
3. Click the Connect to Azure DevOps button.

Step 2: Login step with Connect to Azure DevOps button.

You will be redirected to Microsoft’s sign-in and consent flow.

---

Step 3 – Sign in and accept permissions (Microsoft)

1. Sign in with your Microsoft account if prompted.
2. Review the Permissions requested by the Conviso Platform application (e.g. access to Visual Studio Team Services REST APIs, Code, Build, Project and team, etc.).
3. Click Accept to grant the requested permissions.

Accepting this screen authorizes Conviso to call Azure DevOps as your user. It does not grant Edit subscriptions on the project. If that account is not a Project Administrator (or equivalent), repositories can still import while Service Hooks fail to register — then PR Scans and AST Orchestrator will not trigger. See Service hook permissions.

Step 3: Microsoft permissions consent screen.

After accepting, you will be redirected back to the Conviso Platform.

---

Step 4 – Select organizations and authorize repositories (Authorization)

1. Back in Conviso Platform, you will be on the Authorize access card.
2. In Select organizations, click the field and choose one or more Azure DevOps organizations to use. Repositories from these organizations will be available to import.
3. Choose how to authorize repositories:
   • Authorize all repositories: Turn the Authorize all repositories toggle on to automatically detect and authorize all repositories from the selected organization(s).
   • Select specific repositories: Turn the toggle off to open Select repositories to authorize and choose only the repositories you want.
4. Click Authorize and import.

Step 4: Authorization – select organizations and authorize all or selected repositories.

If you chose to select specific repositories, use the dropdown as in the image below:

Step 4b: Selecting specific repositories to authorize.

---

Step 5 – Set up the scans

Once authorized, the Azure DevOps page shows:

• Authorized access: the authentication mode, organizations, and repositories Conviso can read. Edit reopens the authorization.
• Conviso scans in this organization: how scans run. Set up scans (or Open setup) takes you to Scan Setup, where you turn on PR Scans and AST scans on merge, set the orchestrator pipeline, and manage the imported repositories.
• Remove integration: disconnects Azure DevOps. Assets already imported and their findings stay.
• Check connection and Reconnect, at the top, confirm or renew Conviso's access.

---

Authorize all repositories – how new repos and projects are included

If you turned on Authorize all repositories in Step 4, the platform keeps your assets in sync as follows:

• New repository in an existing project: When a repository is created in a project that is already part of the integration, the platform is notified and the new repository is imported as an asset automatically.
• New project: Azure DevOps does not notify the platform when a new project is created. The platform runs a daily sync (during the night, UTC) that finds new projects in your organization(s) and imports their existing repositories. Once a project is discovered, any new repositories created in it afterward are automatically imported in real time, just like existing projects.

If you chose Select specific repositories, only the repositories you selected at configuration time are imported; no automatic sync runs for new repos or new projects.

Service hook permissions

Conviso creates Azure DevOps Service Hooks (webhooks) on each project that has imported repositories. Those subscriptions are how Azure notifies the platform of:

• A new repository in a project that is already connected (git.repo.created)
• A pull request created or updated — required for PR Scans
• A pull request merged — required for AST Orchestrator

Microsoft grants Edit subscriptions and View subscriptions to Project Administrators by default. A user who can clone and import repositories may still lack this permission.

Turning on Conviso PR Scans or Conviso AST Scans in Scan Setup does not create the hooks by itself. If the connecting account cannot edit subscriptions, the toggle has no effect until an administrator grants the permission (or reconnects the integration with a Project Administrator account) and Conviso can register the hooks.

Grant Edit subscriptions

On each Azure DevOps project you import from:

1. Open the project → Project settings → Permissions (or Security).
2. Select the user or group that connected Conviso Platform.
3. Set Edit subscriptions and View subscriptions to Allow.

Alternatively, add that account to Project Administrators on the project.

To confirm hooks exist after the permission is granted: Project settings → Service hooks. You should see Web Hooks subscriptions whose URL contains /callback/azure-devops.

Validation

• Connect: After Step 2 and 3, you return to Conviso Platform on the Authorize access card.
• Authorization: After Step 4, the page shows Authorized access with the organizations you chose.
• Repositories: The Repositories card of the Azure DevOps setup in Scan Setup lists each repository imported as an asset (e.g. organization/repository-name). You can open an asset to confirm it is linked correctly.

If Check connection is available, use it to confirm that the integration can still access Azure DevOps with the current credentials.

Troubleshooting

Problem	What to do
"OAuth state is required" or "Invalid or expired OAuth state"	Do not modify the URL when returning from Microsoft. Use Connect to Azure DevOps again and complete the consent in one go. If the error persists, try in a new browser tab or clear cookies for the Conviso Platform domain.
"Azure DevOps OAuth is not configured"	The Conviso Platform instance is missing OAuth configuration (client ID, secret, redirect URI). Contact your platform administrator.
No organizations in the dropdown	Ensure your Microsoft account has access to at least one Azure DevOps organization. Check at https://dev.azure.com.
"The integration must have at least one organization selected"	You must select at least one organization on Authorize access before importing repositories. Select at least one organization and try again.
Repositories do not appear after import	Import is processed asynchronously. Wait a few moments and refresh the page. If they still do not appear, use Check connection and try importing again.
Assets imported, but PR scans / merge AST / new-repo auto-import do not run	The connecting account likely lacks Edit subscriptions on the Azure project. Grant it (see Service hook permissions), then reconnect or ask Conviso support to re-register the Service Hooks. In Azure, Project settings → Service hooks should list a Web Hook to Conviso. Accepting the Microsoft OAuth consent screen is not sufficient.

Support

If you have any questions or need assistance with the Azure DevOps integration, contact the Conviso support team.

Related Guides

• Scan Setup
• Azure DevOps Service Principal
• Azure DevOps PR Scans
• Azure DevOps AST Orchestrator

Explore other Conviso Platform integrations and get started.