> ## Documentation Index > Fetch the complete documentation index at: https://docs.backline.ai/llms.txt > Use this file to discover all available pages before exploring further. # Azure DevOps Integration > Connect your Azure DevOps organizations to Backline through Backline's Microsoft Entra app ## Overview Backline integrates with Azure DevOps Services to open pull requests that remediate known vulnerabilities in your Azure Repos. Backline connects through its own Microsoft Entra app: you approve the app once for your Entra tenant, give it access in each Azure DevOps organization, and connect each organization in Backline. There are no tokens or secrets to create or rotate. ## What You Can Do With the Azure DevOps integration, Backline can: * Access every repository the app can write to in each connected organization * Create pull requests with automated security fixes, with your tenant's PR settings (labels, draft PRs, code-owner reviewers) * Add owners as reviewers, from the repository's branch policies' automatically included reviewers or, when it has none, from its `CODEOWNERS` file * Read build validation and status check results on its pull requests and fix failing builds * Keep its pull requests up to date with their target branch * Mark findings fixed when a pull request merges ## Prerequisites Before connecting Azure DevOps, ensure you have: * An Azure DevOps Services organization (`https://dev.azure.com/{organization}`) connected to Microsoft Entra ID * A Microsoft Entra administrator who can approve applications for the tenant (for example, **Cloud Application Administrator**), unless your tenant lets users consent to apps * An Azure DevOps **Project Collection Administrator** in each organization, to add the app and give it access * A Microsoft account that is a member of the organization, to sign in when connecting > [!NOTE] > > Azure DevOps Server (on-premises) and organizations that are not connected to Microsoft Entra ID are not supported. ## Backline's Entra App Backline connects through its Entra app **Backline Azure DevOps** (application ID `b005f2e4-2cf0-4424-b176-65fcd861d71e`). The app asks only to sign users in (`openid`, `profile`); what it can do in Azure DevOps is set only by the access you give it in each organization. ## Connecting Azure DevOps **1. Approve Backline's app for your Entra tenant** Once per Entra tenant, an Entra administrator approves the app, which adds it to the tenant's **Enterprise applications**. Open this link, replacing `` with your tenant ID, and accept: ```text theme={null} https://login.microsoftonline.com//adminconsent?client_id=b005f2e4-2cf0-4424-b176-65fcd861d71e ``` Or, with the Azure CLI: ```bash theme={null} az ad sp create --id b005f2e4-2cf0-4424-b176-65fcd861d71e ``` > [!TIP] > > If your tenant lets users consent to apps, signing in during the connect step below also approves the app. You still need it approved before you can add it to an organization in the next step. **2. Add the app to your Azure DevOps organization** In Azure DevOps, go to **Organization settings** → **Users** → **Add users**. Search for **Backline Azure DevOps**, set the access level to **Basic**, and add it to the **Contributors** group of each project Backline should cover. Backline covers every repository the app can write to. To cover a project later, add the app to that project's Contributors group, then select **Refresh** from the **three dots menu** on the Azure DevOps card. **3. Go to Integration Hub** Navigate to Integrations from the main menu in Backline. **4. Select Azure DevOps** Find and click on the Azure DevOps integration card under the **Source Code Management** category. **5. Enter your organization** Enter the organization name from `https://dev.azure.com/{organization}` and click **Connect**. **6. Sign in with Microsoft** Sign in with an account from your organization's Entra tenant that is a member of the organization. Backline checks the membership, that the app has Basic access, and that it can write to at least one repository, then lists the repositories. To connect another organization, repeat the last four steps. Organizations in the same Entra tenant don't need the app approved again. ## Required Access | Access | Where | Purpose | | - | - | - | | Basic access level | Organization | Lets the app use Azure Repos | | Contributors group | Each covered project | Push fix branches, open and update pull requests, add reviewers | ## How It Works * **Repositories:** repositories the app gains write access to appear after the next daily refresh, or right away when you select **Refresh** from the **three dots menu** on the Azure DevOps card. Repositories it can no longer write to are removed at the next refresh. * **Pull requests:** Backline opens pull requests against the default branch, or the target branch set in your PR settings. In draft pull requests, where Azure DevOps does not start build validation, Backline starts it. * **Reviewers:** Backline adds owners as reviewers itself, so draft pull requests get them too. When the pull request is published, Azure DevOps adds its own policy reviewers without duplicating them. * **CI:** Backline reads the pull request's build validation and status check results. A pull request with no build validation policy shows no CI result. * **Keeping pull requests current:** when the target branch moves, Backline merges it into its open pull requests, a few per organization at a time to stay within Azure DevOps rate limits. ## Troubleshooting | Message | What to do | | - | - | | Backline's Azure DevOps app has no access in your Microsoft Entra tenant | Approve the app for your tenant (step 1) and connect again | | Backline's app is not added to Azure DevOps organization … | Add the app to the organization with Basic access (step 2) | | Backline's app cannot write to any repository in Azure DevOps organization … | Add the app to the Contributors group of at least one project | | The account you signed in with is not a member of Azure DevOps organization … | Sign in with an account that belongs to the organization | | Sign in with an account from the Microsoft Entra tenant of Azure DevOps organization … | Sign in with an account from the organization's Entra tenant, not a personal or guest account from another tenant | | Azure DevOps organization … is not connected to Microsoft Entra | Connect the organization to Entra ID in **Organization settings** → **Microsoft Entra**, or use an Entra-connected organization | | The sign-in expired or was already used | Start connecting again | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.