> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure DevOps Integration

> Connect Azure DevOps repositories to CodeThreat

Connect Azure DevOps to scan your repositories for security vulnerabilities.

## Connection Methods

<Tabs>
  <Tab title="Personal Access Token (Recommended)">
    **Best for**: Most users

    * Full control over permissions
    * Works with Azure DevOps Services and Server
    * No OAuth setup required

    **Requirements**: Azure DevOps access
  </Tab>

  <Tab title="OAuth">
    **Best for**: Azure DevOps Services

    * Quick authorization
    * Automatic token management
    * Cloud-only

    **Requirements**: Azure DevOps Services account
  </Tab>
</Tabs>

***

## Personal Access Token Setup

<Steps>
  <Step title="Open Azure DevOps">
    Navigate to [dev.azure.com](https://dev.azure.com) and sign in
  </Step>

  <Step title="Open User Settings">
    Click your profile icon (top right) → **Personal access tokens**
  </Step>

  <Step title="Create New Token">
    Click **+ New Token**

    **Name**: `CodeThreat Security Scanner`
    **Organization**: Select your organization
    **Expiration**: Choose expiration date
    **Scopes**: Select:

    * ✅ **Code**: Read
    * ✅ **Pull Requests**: Read
    * ✅ **Project and Team**: Read
    * ✅ **Service Hooks**: Read & write (for webhooks)
  </Step>

  <Step title="Create and Copy Token">
    Click **Create** and copy the token immediately
  </Step>

  <Step title="Add to CodeThreat">
    **Settings** → **Integrations** → **Azure DevOps** → Select **Personal Access Token**

    Paste token and enter organization name (from URL: `dev.azure.com/{organization}`)
  </Step>

  <Step title="Import Repositories">
    Select repositories from your Azure DevOps projects
  </Step>
</Steps>

***

## Azure DevOps Server

CodeThreat supports on-premises Azure DevOps Server (formerly TFS).

### Requirements

* Azure DevOps Server 2019 or later
* Network connectivity to your server
* Valid SSL certificate

When connecting with PAT, enter your server URL:

```
https://devops.company.com/
```

***

## Webhook Configuration

CodeThreat creates service hooks in Azure DevOps for automated scanning.

### Service Hook Events

* **Code pushed**: Trigger scans on commits
* **Pull request created**: Scan new PRs
* **Pull request updated**: Rescan on PR changes

### Verify Service Hooks

1. In Azure DevOps: Project → **Project settings** → **Service hooks**
2. Find hooks with target URL: `https://app.codethreat.com/webhooks/azuredevops`
3. Click the hook → **Test** to verify delivery

***

## Pull Request Integration

Get security feedback in Azure DevOps pull requests.

### PR Status Checks

CodeThreat appears as a status check on PRs:

* ✅ **Succeeded**: No critical/high vulnerabilities
* ❌ **Failed**: Security issues found
* ⏳ **Pending**: Scan in progress

### Branch Policies

Require CodeThreat checks before merging:

1. Azure DevOps Project → **Repos** → **Branches**
2. Select branch → **Branch policies**
3. **Status checks** → **Add status policy**
4. Select **CodeThreat Security Scan**
5. Set policy to **Required**

***

## Permissions

To connect Azure DevOps, you need:

* **Project Collection Administrator** (to create service hooks)
* Or **Project Administrator** (project-level connection)

***

## Best Practices

* Use organization-wide tokens
* Set token expiration (rotate every 90-180 days)
* Enable PR scanning
* Use branch policies to require security checks

***

## Troubleshooting

**Connection failed**:

* Verify token scopes are correct
* Check organization name matches Azure DevOps
* Ensure token hasn't expired

**Repositories not showing**:

* Verify you have Read access to repositories
* Check if project name filter is too restrictive
* Re-authorize the connection

**Service hooks not triggering**:

* Check service hook status in Azure DevOps
* Verify CodeThreat webhook URL is reachable
* Ensure firewall allows outbound HTTPS

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Run Your First Scan" icon="play" href="/scanning/running-scans">
    Start scanning Azure DevOps repositories
  </Card>

  <Card title="PR Scanning" icon="code-pull-request" href="/scanning/pr-scanning">
    Get security feedback on pull requests
  </Card>
</CardGroup>