> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# Azure DevOps

> Connect Azure DevOps organizations so Enclave can read and learn your Azure Repos repositories.

Connect Azure DevOps so Enclave can read and learn the repositories in your Azure DevOps organizations.

## Before you start

You need the **Owner** or **Admin** role in Enclave.

In Azure DevOps, the account you connect with needs **Project Administrator** on the projects you want scanned, or the **Edit Subscription** permission. Enclave uses it to create the service hooks that send push events. Without it, Enclave can read your code but doesn't see new commits.

## Connect Azure DevOps

**1. Open integrations**

Open **Settings → Integrations** in [app.enclave.ai](https://app.enclave.ai). Click **Connect** next to **Azure DevOps**.

**2. Choose how to sign in**

Pick the option that matches how you sign in to Azure DevOps.

> [tab] Microsoft Entra ID
>
> Use this for a work or school account.
>
> 1. Click **Microsoft Entra ID** and sign in with Microsoft.
> 2. Under **Choose organizations to connect**, select the Azure DevOps organizations Enclave should read.
> 3. Click **Connect**.
>
> You can connect more organizations later.

> [tab] Personal access token
>
> Use this if you sign in with a personal Microsoft account. Microsoft Entra ID can't issue tokens for personal accounts.
>
> 1. In Azure DevOps, create a personal access token that can read code, list projects, and manage service hooks. Azure DevOps groups these permissions differently across versions of its token screen. See [Microsoft's token scope reference](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate).
>
> 2. In Enclave, click **Personal access token**.
>
> 3. Enter your **Organization**. It's the path segment in `dev.azure.com/<organization>`.
>
> 4. Paste the token and click **Validate & connect**.
>
> > [!TIP]
> >
> > Use a token from a service account instead of a personal one. Activity appears under whichever account owns the token.

**3. Confirm the connection**

Back in **Settings → Integrations → Azure DevOps**, the organization appears under **Organizations** with its repository count.

## Permissions

Enclave uses the connection to:

* **Read repositories, branches and pull requests.** Enclave reads your code and its history.
* **Create and remove service hook subscriptions.** Enclave subscribes to push and pull request events so it knows when code changes.
* **Create and update Azure Boards work items for findings.** This needs the **Work Items (read & write)** permission. Connecting Azure DevOps is what connects Azure Boards. There's no separate setup.

## Manage the connection

Open **Settings → Integrations → Azure DevOps** to see your connected organizations.

* **Resync** picks up projects and repositories created after you connected. Azure DevOps doesn't notify Enclave when they're created, so click **Resync** after adding one. It also re-checks permissions after you fix them.
* **Add organization** connects another Azure DevOps organization.
* **Remove** disconnects an organization. Enclave stops scanning its repositories. You can reconnect later.

## Troubleshooting

> [accordion] The organization shows "push events not active"
>
> Enclave read your repositories but couldn't create service hooks. Grant the connecting account **Edit Subscription** (or **Project Administrator**) on the projects, then click **Resync**.

> [accordion] The organization shows "Azure Boards unavailable"
>
> The connection can't create work items. Grant **Work Items (read & write)**, then click **Resync**.

> [accordion] A new project or repository doesn't appear
>
> Click **Resync** on the organization. For a large organization, the resync keeps running after you click. Repositories appear as they sync.

> [accordion] Token validation fails
>
> * **Azure DevOps rejected this token**: the token expired or was revoked. Create a new one.
> * **This token can't do everything Enclave needs**: recreate the token so it can read code, list projects, and manage service hooks.
> * **This token authenticated but can't see any projects**: add the token's owner to a project in **Project Settings → Permissions**.
> * **We couldn't reach that Azure DevOps organization**: check the organization name and your network rules.

> [accordion] The organization shows "reconnect needed"
>
> Enclave can no longer use the connection's credentials. Remove the organization and connect it again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.