Skip to main content

Azure DevOps

Overview​

Connect Azure DevOps to StackGuardian to source Infrastructure as Code (IaC) and Policy code from your repositories and trigger Workflow runs automatically.

Set up the connector​

  1. In StackGuardian, navigate to Organization Settings → Connectors → Version control providers.
  2. Select + Connect with VCS provider.
  3. In the Connect with VCP modal, select Azure DevOps as the version control provider.
  4. Choose an authentication method:

Service principal with federated credentials​

This method uses an Azure AD service principal with federated credentials via OpenID Connect (OIDC) to authenticate with Azure DevOps. It avoids managing client secrets by using a trusted identity provider.

Before setting up the connector, you must configure an Azure AD application with:

  • Tenant ID (Directory ID)
  • Client ID (Application ID)
  • Federated credentials configured for StackGuardian
  • Permissions to access Azure DevOps

You must also add the service principal as a user in your Azure DevOps organization and grant it:

  • Basic access level (required for API access)
  • Reader permissions on the relevant projects
Client Secret connector creation form showing access type selection and input fields for Tenant ID, Subscription ID, Client ID, and Client Secret Value

Service principal with federated credentials

Configure Connector in StackGuardian​

To complete the connection, visit the StackGuardian platform and follow these steps:

  1. Go to the Connectors tab in the StackGuardian Orchestrator.
  2. Click on Version Control Providers > Connect with VCS Provider.
  3. Click on Azure DevOps.
  4. Select Service principal with federated credentials as the Access Type.
  5. Enter a Connector name.
  6. Enter the following information:
    • Tenant ID (Directory ID)
    • Subscription ID
    • Client ID (Application ID)
  7. Click Create to finalize the configuration of the Connector.
Azure DevOps connector configuration in StackGuardian showing the Personal Access Token authentication method with connector name and token input fields

Personal Access Token connector creation

Service principal with client secret​

This method uses an Azure AD service principal with a client secret to authenticate with Azure DevOps.

Before setting up the connector, you must configure an Azure AD application with:

  • Tenant ID (Directory ID)
  • Client ID (Application ID)
  • Client secret
  • Permissions to access Azure DevOps

You must also add the service principal as a user in your Azure DevOps organization and grant it:

  • Basic access level (required for API access)
  • Reader permissions on the relevant projects

Configure Connector in StackGuardian​

  1. Go to the Connectors tab in the StackGuardian Orchestrator.
  2. Click on Version Control Providers > Connect with VCS Provider.
  3. Click on Azure DevOps.
  4. Select Service principal with client secret as the Access Type.
  5. Enter a Connector name.
  6. Enter the following information:
    • Tenant ID (Directory ID)
    • Subscription ID
    • Client ID (Application ID)
    • Client Secret Value
  7. Click Create to finalize the configuration of the Connector.
Service principal with client secret

Service principal with client secret

Personal access token​

To connect Azure DevOps using a Personal access token, you need to create a token in Azure DevOps with limited permissions:

  1. On the Azure DevOps platform, go to the target repository for the Access Token.
  2. Select User Settings on the top navbar, beside your profile name.
  3. Under the dropdown select Personal Access Tokens.
  4. Click on New Token.
  5. Provide a name for the token that relates to the app or task using it.
  6. Select the required Scopes for the token.
  7. Click Create to generate the token.
  8. Copy the generated token and securely store it for later use.
Azure DevOps personal access token creation process showing user settings menu, token configuration form with name and scopes selection, and token generation

Azure DevOps token creation

Configure Connector in StackGuardian​

To complete the connection, visit the StackGuardian platform and follow these steps:

  1. Go to the Connectors tab in the StackGuardian Orchestrator.
  2. Click on Version Control Providers > Connect with VCS Provider.
  3. Click on Azure DevOps.
  4. Enter a Connector name.
  5. Select Personal access token as the Access Type.
  6. In the Personal access token field, paste the Access token created earlier.
  7. Click Create to finalize the configuration of the Connector.
Azure DevOps connector configuration in StackGuardian showing the Personal Access Token authentication method with connector name and token input fields

Personal Access Token connector creation