Skip to main content
Connect Azure DevOps so Enclave can read and learn the repositories in your Azure DevOps organizations.

​
Before you start

You need the Owner or Admin role in Enclave. In Azure DevOps, the account you connect with needs Project Administrator on the projects you want scanned, or the Edit Subscription permission. Enclave uses it to create the service hooks that send push events. Without it, Enclave can read your code but doesn’t see new commits.

​
Connect Azure DevOps

1

Open integrations

Open Settings → Integrations in app.enclave.ai. Click Connect next to Azure DevOps.
2

Choose how to sign in

Pick the option that matches how you sign in to Azure DevOps.
Use this for a work or school account.
  1. Click Microsoft Entra ID and sign in with Microsoft.
  2. Under Choose organizations to connect, select the Azure DevOps organizations Enclave should read.
  3. Click Connect.
You can connect more organizations later.
3

Confirm the connection

Back in Settings → Integrations → Azure DevOps, the organization appears under Organizations with its repository count.

​
Permissions

Enclave uses the connection to:
  • Read repositories, branches and pull requests. Enclave reads your code and its history.
  • Create and remove service hook subscriptions. Enclave subscribes to push and pull request events so it knows when code changes.
  • Create and update Azure Boards work items for findings. This needs the Work Items (read & write) permission. Connecting Azure DevOps is what connects Azure Boards. There’s no separate setup.

​
Manage the connection

Open Settings → Integrations → Azure DevOps to see your connected organizations.
  • Resync picks up projects and repositories created after you connected. Azure DevOps doesn’t notify Enclave when they’re created, so click Resync after adding one. It also re-checks permissions after you fix them.
  • Add organization connects another Azure DevOps organization.
  • Remove disconnects an organization. Enclave stops scanning its repositories. You can reconnect later.

​
Troubleshooting

Enclave read your repositories but couldn’t create service hooks. Grant the connecting account Edit Subscription (or Project Administrator) on the projects, then click Resync.
The connection can’t create work items. Grant Work Items (read & write), then click Resync.
Click Resync on the organization. For a large organization, the resync keeps running after you click. Repositories appear as they sync.
  • Azure DevOps rejected this token: the token expired or was revoked. Create a new one.
  • This token can’t do everything Enclave needs: recreate the token so it can read code, list projects, and manage service hooks.
  • This token authenticated but can’t see any projects: add the token’s owner to a project in Project Settings → Permissions.
  • We couldn’t reach that Azure DevOps organization: check the organization name and your network rules.
Enclave can no longer use the connection’s credentials. Remove the organization and connect it again.