> For the complete documentation index, see [llms.txt](https://docs.sprinto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sprinto.com/integrations/overview/azure-devops-integration-access-review-and-version-control.md).
# Azure DevOps Integration (Access Review & Version Control)
Sprinto uses this connection to monitor change management, branch protection, peer reviews, and repository security. Sprinto uses Microsoft Entra ID OAuth to sign in to Azure DevOps.
## Prerequisites
* **Role:** You need Organization Owner access to the Azure DevOps organization you want to connect.
* **Microsoft account:** Sign in with a Microsoft account that is an owner of that Azure DevOps organization. See [Which account to use](#which-account-to-use).
* **Tenant:** If your Azure DevOps organization is in a different Microsoft Entra tenant than your personal account, have the tenant ID (GUID) or verified domain ready. You can find it in the Azure portal under Microsoft Entra ID > Overview.
## Which account to use
The account you sign in with decides what Sprinto can see. If it is not an owner of your Azure DevOps organization, Sprinto cannot see your repositories or projects.
* Sign in with a Microsoft account that is an **owner** of your Azure DevOps organization. Being signed in to Microsoft is not enough; the account must also belong to the organization.
* We recommend a **dedicated integration account** instead of a personal admin account, so access does not change when people leave or change roles.
* The account must be able to sign in without being blocked by your **Conditional Access** policies, for example device-compliance rules. Sprinto renews access in the background, so a policy that blocks background sign-ins will stop the sync.
* Use a **private browser window** and sign out of other Microsoft accounts first, so the wrong account is not chosen automatically.
* Check the account name shown on the Microsoft sign-in and consent screens before you click Accept.
## Permissions and data
Sprinto requests these permissions: `vso.code`, `vso.build`, and `vso.memberentitlementmanagement`.
Sprinto reads: accounts, profile data, projects, branches, repositories, latest SIScan run information, dependency vulnerability report, users, users for account, and pull requests.
## Setting up the integration
{% stepper %}
{% step %}
### Log in to Sprinto
Log in to Sprinto.
{% endstep %}
{% step %}
### Open Integrations
Click **Settings** at the bottom left, then **Integrations**.
{% endstep %}
{% step %}
### Connect Azure DevOps
Search for **Azure DevOps** and click **Connect**. The drawer shows the connection type as OAuth.
{% endstep %}
{% step %}
### Enter the Microsoft Entra tenant ID (optional)
Enter a tenant ID (GUID) or verified domain only if your Azure DevOps organization uses a different tenant than your Microsoft account. Leave this field blank otherwise.
{% endstep %}
{% step %}
### Start the connection
Click **Connect** at the bottom of the drawer. You are redirected to the Microsoft sign-in page.
{% endstep %}
{% step %}
### Sign in and accept permissions
Sign in with the account described in [Which account to use](#which-account-to-use), review the permissions, and click **Accept**.
{% endstep %}
{% step %}
### Confirm the connection
You are redirected back to Sprinto and the first sync starts. A connected status appears when setup finishes.
{% endstep %}
{% step %}
### Add another Azure DevOps organization
Click **Add** next to Azure DevOps to add it as a change management system. Use Add only to connect a **different** Azure DevOps organization. Do not add the same organization twice.
{% endstep %}
{% endstepper %}
## After setup
Sprinto starts the first sync as soon as you connect. For most organizations, repositories and projects appear within about 30 minutes; larger organizations can take longer. After that, Sprinto refreshes your Azure DevOps data automatically at least once a day.
Sprinto reports on branch protection rules and enforcement, peer review compliance on pull requests, change management tracking for audit readiness, and repository security configurations.
{% hint style="info" %}
**To confirm the connection is working,** open the Change Management page and check that your repositories and projects are listed. If none appear, the signed-in account is probably not an owner of your Azure DevOps organization. See [Troubleshooting](#troubleshooting).
{% endhint %}
## Migrating from the legacy Azure DevOps connection
Earlier versions of this integration signed in with the Azure DevOps OAuth service. Sprinto now uses Microsoft Entra ID OAuth. If you connected Azure DevOps before the change, a banner on the Change Management page asks you to reconnect. Reconnect from your existing connection. Do not use Connect or Add, which create a second connection.
{% stepper %}
{% step %}
### Find the reconnection banner
Open **Change Management** and find the banner.
{% endstep %}
{% step %}
### Reconnect the existing connection
Click **Reconnect now**. This opens your existing connection.
{% endstep %}
{% step %}
### Enter the tenant ID if needed
Enter the tenant ID only if your Azure DevOps organization uses a different tenant (see [Prerequisites](#prerequisites)).
{% endstep %}
{% step %}
### Sign in and accept permissions
Sign in with the account described in [Which account to use](#which-account-to-use) and click **Accept**.
{% endstep %}
{% step %}
### Verify your data
Check that your repositories and projects appear (see [After setup](#after-setup)).
{% endstep %}
{% endstepper %}
## Troubleshooting
| **What you see** | **What it means** | **What to do** |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| No repositories or projects after connecting | The signed-in account is not an owner of the Azure DevOps organization. | Reconnect with an owner account, in a private window. |
| AADSTS53000 "Device is not in required device state: compliant", or VS403463 | A Conditional Access policy in your Microsoft Entra tenant is blocking the account. | Ask your Entra admin to allow the integration account for the Sprinto app, then reconnect. |
| AADSTS700082 | The refresh token expired after about 90 days without activity. | Reconnect from the banner or your existing connection. |
| 401 TF400813 "user is not authorized" | The account is not authorized in the Azure DevOps organization. | Make it an owner of the organization, or reconnect with an account that is. |
| Invalid tenant ID error | The tenant ID is not a valid GUID or domain. | Enter a properly formatted GUID or a valid domain, or leave the field blank. |
## Need help?
Contact Sprinto Support through the in-app chat or at .
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.sprinto.com/integrations/overview/azure-devops-integration-access-review-and-version-control.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
