Authenticate to Azure DevOps with Microsoft Entra ID

Azure DevOps Services

Use this article to choose a Microsoft Entra ID authentication flow for applications that access Azure DevOps Services.

Overview

Microsoft Entra ID is Microsoft's cloud-based identity and access management platform that lets organizations:

• Manage user identities and control access to resources.
• Apply security policies such as multifactor authentication and Microsoft Entra Conditional Access to supported sign-in scenarios.
• Integrate with thousands of applications, including Azure DevOps Services.
• Provide single sign-on across Microsoft and non-Microsoft services.

Many Azure DevOps enterprise customers connect their Azure DevOps organization to Microsoft Entra ID to use these capabilities and enhanced security features.

Authentication options

The Microsoft Identity platform provides two primary authentication patterns for Azure DevOps access.

User delegation (OAuth)

Best for: Interactive applications that act for users

• Users sign in with their Microsoft Entra ID credentials.
• Applications act within the signed-in user's Azure DevOps access level and permissions.
• Multifactor authentication and Microsoft Entra Conditional Access policies evaluate user sign-ins.
• This pattern works well for web applications, desktop apps, and other user-facing tools.

Get started: Microsoft Entra ID OAuth implementation

Application identity (service principals and managed identities)

Best for: Background services and automation scenarios

• Applications authenticate by using their own identity (not user credentials).
• This pattern works well for continuous integration and continuous delivery (CI/CD) pipelines, background services, and automated tools.
• Add the identity to the Azure DevOps organization and assign the required access level and permissions.
• Use managed identities for Azure-hosted applications. Use service principals with workload identity federation, certificates, or client secrets for other applications.

Get started: Service principals and managed identities

Why use Microsoft Entra ID authentication

Microsoft Entra ID centralizes identity lifecycle and access controls for users and applications.

Identity and credential controls

• User authentication can use single sign-on, multifactor authentication, and supported Conditional Access policies.
• Managed identities and workload identity federation can avoid stored application secrets in supported scenarios.
• Administrators can disable an identity or change its Azure DevOps access without updating each application.

Conditional Access behavior depends on the identity and authentication flow. For workload identity limitations, see Service principals and managed identities.

Enterprise integration

• Single sign-on across Microsoft and non-Microsoft applications
• Centralized identity management for users and applications
• Policy enforcement for supported identities and sign-in scenarios
• Audit and compliance capabilities for governance requirements

Developer experience

• Microsoft authentication libraries that acquire and cache tokens
• Consistent identity platform across all Microsoft services
• Rich documentation and samples for quick implementation
• Active support and development with regular feature updates

Handle access tokens

Treat Microsoft Entra access tokens as sensitive, opaque credentials. Don't parse a token or hard-code its lifetime. Use the expiration information returned with the token, and use Microsoft Authentication Library (MSAL) or Azure Identity to cache tokens and acquire another token when needed. Whether a token can be renewed without user interaction depends on the authentication flow, session state, and applicable policies.

Migrate from legacy authentication

Azure DevOps OAuth is deprecated, and Microsoft no longer accepts new app registrations as of April 2025. Use Microsoft Entra ID OAuth for new applications and migrate existing Azure DevOps OAuth applications. For current deprecation milestones, see the Azure DevOps OAuth deprecation announcement.

Organizations increasingly adopt security policies that restrict personal access token (PAT) creation because of security risks. Microsoft Entra ID authentication provides secure alternatives for common PAT scenarios.