Skip to main content

​
Overview

Backline integrates with Azure DevOps Services to open pull requests that remediate known vulnerabilities in your Azure Repos. Backline connects through its own Microsoft Entra app: you approve the app once for your Entra tenant, give it access in each Azure DevOps organization, and connect each organization in Backline. There are no tokens or secrets to create or rotate.

​
What You Can Do

With the Azure DevOps integration, Backline can:
  • Access every repository the app can write to in each connected organization
  • Create pull requests with automated security fixes, with your tenant’s PR settings (labels, draft PRs, code-owner reviewers)
  • Add owners as reviewers, from the repository’s branch policies’ automatically included reviewers or, when it has none, from its CODEOWNERS file
  • Read build validation and status check results on its pull requests and fix failing builds
  • Keep its pull requests up to date with their target branch
  • Mark findings fixed when a pull request merges

​
Prerequisites

Before connecting Azure DevOps, ensure you have:
  • An Azure DevOps Services organization (https://dev.azure.com/{organization}) connected to Microsoft Entra ID
  • A Microsoft Entra administrator who can approve applications for the tenant (for example, Cloud Application Administrator), unless your tenant lets users consent to apps
  • An Azure DevOps Project Collection Administrator in each organization, to add the app and give it access
  • A Microsoft account that is a member of the organization, to sign in when connecting
Azure DevOps Server (on-premises) and organizations that are not connected to Microsoft Entra ID are not supported.

​
Backline’s Entra App

Backline connects through its Entra app Backline Azure DevOps (application ID b005f2e4-2cf0-4424-b176-65fcd861d71e). The app asks only to sign users in (openid, profile); what it can do in Azure DevOps is set only by the access you give it in each organization.

​
Connecting Azure DevOps

1

Approve Backline's app for your Entra tenant

Once per Entra tenant, an Entra administrator approves the app, which adds it to the tenant’s Enterprise applications. Open this link, replacing <tenant-id> with your tenant ID, and accept:
Or, with the Azure CLI:
If your tenant lets users consent to apps, signing in during the connect step below also approves the app. You still need it approved before you can add it to an organization in the next step.
2

Add the app to your Azure DevOps organization

In Azure DevOps, go to Organization settings → Users → Add users. Search for Backline Azure DevOps, set the access level to Basic, and add it to the Contributors group of each project Backline should cover.Backline covers every repository the app can write to. To cover a project later, add the app to that project’s Contributors group, then select Refresh from the three dots menu on the Azure DevOps card.
3

Go to Integration Hub

Navigate to Integrations from the main menu in Backline.
4

Select Azure DevOps

Find and click on the Azure DevOps integration card under the Source Code Management category.
5

Enter your organization

Enter the organization name from https://dev.azure.com/{organization} and click Connect.
6

Sign in with Microsoft

Sign in with an account from your organization’s Entra tenant that is a member of the organization. Backline checks the membership, that the app has Basic access, and that it can write to at least one repository, then lists the repositories.
To connect another organization, repeat the last four steps. Organizations in the same Entra tenant don’t need the app approved again.

​
Required Access

​
How It Works

  • Repositories: repositories the app gains write access to appear after the next daily refresh, or right away when you select Refresh from the three dots menu on the Azure DevOps card. Repositories it can no longer write to are removed at the next refresh.
  • Pull requests: Backline opens pull requests against the default branch, or the target branch set in your PR settings. In draft pull requests, where Azure DevOps does not start build validation, Backline starts it.
  • Reviewers: Backline adds owners as reviewers itself, so draft pull requests get them too. When the pull request is published, Azure DevOps adds its own policy reviewers without duplicating them.
  • CI: Backline reads the pull request’s build validation and status check results. A pull request with no build validation policy shows no CI result.
  • Keeping pull requests current: when the target branch moves, Backline merges it into its open pull requests, a few per organization at a time to stay within Azure DevOps rate limits.

​
Troubleshooting