Azure DevOps provides services for source control, work tracking, builds and releases, test plans, and package management.
It can be connected to Agen.co two ways, matching the Official / In-house filter in the connector picker:
- Official — Agen.co connects through Microsoft's own hosted Azure DevOps MCP server (
https://mcp.dev.azure.com/{organization}), so your AI agents use the same repository, work item, pipeline, wiki, and test plan tools Microsoft exposes to MCP clients like Visual Studio Code. Authorization is Microsoft Entra ID OAuth through an app you register in your Entra tenant. - In-house — Agen.co wraps the Azure DevOps REST API directly through its own integration layer, using a Microsoft Entra ID OAuth 2.0 app you register in the Azure portal.
Pick Official if the built-in MCP tools cover what your agents need. Fall back to In-house if you need the Azure DevOps REST API surface beyond them, or if Microsoft's server does not accept the connection.
Prerequisites
Prerequisites
- An Azure DevOps organization backed by a Microsoft Entra tenant. Standalone Microsoft account (MSA) organizations are not supported by the remote MCP server.
- Permission to register applications in that Entra tenant, and a tenant administrator to grant admin consent for the API permission below. Depending on your role, the administrator may need to do the consent step.
- The Azure DevOps MCP enterprise application provisioned in your tenant (application ID
2a72489c-aab2-4b65-b93a-a91edccf33b8). If you cannot find it when adding the API permission, the connector cannot authenticate. To provision it, a tenant administrator (Application Administrator, Cloud Application Administrator, or Global Administrator) signs in with Azure CLI (az login --tenant <tenantId> --allow-no-subscriptions) and runsaz ad sp create --id 2a72489c-aab2-4b65-b93a-a91edccf33b8. After that, Azure DevOps MCP appears under Enterprise applications. See Microsoft's troubleshooting guide. - Membership in the Azure DevOps project, with access to the resources you want agents to use.
Microsoft documents this server for a short list of clients, and Agen.co is not on it. Microsoft documents a custom Entra app registration with a Web redirect URI and a client secret for Cursor Cloud Agents; these steps follow the same pattern. If Microsoft rejects the sign-in, use the In-house tab.
Microsoft Entra ID has no dynamic client registration for this server, so you register an app yourself and give Agen.co its Client ID and Client Secret. The app needs Agen.co's callback URLs, so start in Agen.co.
- In the Agen.co portal, go to Connectors → My connectors and click Add connector.
- Find Azure DevOps and select it.
- In the Add Azure DevOps panel, keep the Official tab selected. The panel shows two read-only URLs at the bottom — copy both:
- Callback URL — completes the initial OAuth handshake between Agen.co and your Entra app.
- Gateway callback URL — used by the Agen.co MCP gateway for per-user authorization at runtime.
Leave this panel open — you return to it after registering the app in Entra.
- In the Microsoft Entra admin center, go to App registrations and create a new registration. For Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant). The server's sign-in endpoint is
https://login.microsoftonline.com/organizations, and a single-tenant app registration is rejected there withAADSTS50194. - In the app registration, select Authentication (Preview) → Add redirect URI → Web, add both callback URLs from Agen.co, and save.
- Select Certificates & secrets → Client secrets → New client secret, enter a description and an expiration, and click Add. Copy the secret Value immediately — it is shown only once.
- Select API permissions → Add a permission → APIs my organization uses, search for Azure DevOps MCP (or the application ID above), and select it. If the search returns No results, the application is not provisioned in your tenant yet — see the prerequisites.
- Choose the delegated permissions your agents need and click Add permissions. Permissions are named per area, for example
repos.read,repos.write,wit.read,wit.write,pipelines.read,wiki.read,work.read,testplan.read, andadvsec.read, plusAdo.Mcp.Tools. Grant read permissions for read-only use, and write permissions only where agents must make changes. - Click Grant admin consent.
- On the app's Overview page, copy the Application (client) ID.
Agen.co requests https://mcp.dev.azure.com/.default, which means every delegated permission you granted to the app. A tool call succeeds only when both the app's permissions and the signed-in user's Azure DevOps permissions allow it.
Sign-in errors from Entra
Sign-in errors from Entra
AADSTS50011 means a redirect URI on the app does not exactly match the callback URL Agen.co sent — check that both URLs were added under Web. AADSTS7000218 means the client secret in Agen.co is wrong or expired — create a new secret and update the Client Secret field. AADSTS65001 means consent was not granted — grant admin consent on the app's API permissions page. AADSTS700016 means the application was not found in the directory — check that the Client ID is the app's Application (client) ID and that the app lives in the tenant that owns the Azure DevOps organization.
If your tenant uses location-based Conditional Access policies, your Entra administrator may need to allow the remote MCP server IP addresses 20.125.155.22 and 40.74.28.81.
Return to the open Add Azure DevOps panel and fill in the fields:
| Field | Required | Description |
|---|---|---|
| Instance Slug | Yes | Namespaces this instance — it prefixes each imported tool as slug__tool, so several instances of the same MCP can coexist. Prefilled with azure-devops. Use lowercase kebab-case. You can change it later from the connector's settings. |
| Azure DevOps organization | Yes | Your Azure DevOps organization name — the <organization> in dev.azure.com. The field shows contoso as a placeholder. |
| Client ID | Yes | The Application (client) ID of your Entra app. |
| Client Secret | Yes | The client secret Value of your Entra app. |
| Callback URL | — | Read-only. Add it as a Web redirect URI in your Entra app. |
| Gateway callback URL | — | Read-only. Also add it as a Web redirect URI — the MCP gateway uses it for per-user authorization at runtime. |
Each connector instance connects to exactly one Azure DevOps organization. To connect a second organization, add the Azure DevOps connector again with a different Instance Slug and organization name.
- Click Connect. You are redirected to Microsoft to sign in and approve access.
- After you approve, the panel switches to Select the tools to import from Azure DevOps. Every tool is on by default; turn off any you do not want your agents to see.
- Click Add. The connector is created and the selected tools are imported only when you click Add — if you close the panel first, nothing is saved, even if the Microsoft callback page reported success.
| Area | What it covers |
|---|---|
| Core | List organizations, projects, and teams |
| Repos | Repositories, branches, files, commits, and code search; create and update pull requests, reviewers, votes, and comment threads |
| Work items | Read, search, create, update, comment on, and link work items; queries, backlogs, and attachments |
| Pipelines | Builds, logs, definitions, runs, and artifacts; run and create pipelines |
| Wiki | List, read, search, and create or update pages |
| Test plans | Plans, suites, cases, and runs, with create and update operations |
| Work | Iterations and team capacity |
| Advanced Security | List and read alerts for a repository |
| Enterprise Live Migration | Preview tools for managing migrations |
The list follows Microsoft's remote MCP server documentation (checked 2026-10-06) and can change.
Enabling the Azure DevOps connector isn't enough on its own. Tool calls remain denied until you create a policy that grants access to the specific tools you want to expose.
Prerequisites
Prerequisites
- A Microsoft Entra ID tenant with permission to register applications (typically through the Azure portal)
- An Azure DevOps organization linked to the user's Entra tenant
Use Microsoft Entra ID OAuth, not legacy Azure DevOps OAuth
Use Microsoft Entra ID OAuth, not legacy Azure DevOps OAuth
Microsoft retired the legacy Azure DevOps OAuth platform (app.vssps.visualstudio.com) and stopped accepting new registrations. New apps must register through Microsoft Entra ID → App registrations in the Azure portal, as described below.
Sign in to the Azure portal with an account that can register applications in your Microsoft Entra ID tenant. Use the top search bar to find Microsoft Entra ID and open it.
In the Microsoft Entra ID menu, select App registrations, then click + New registration at the top of the page.
Fill in the Register an application form:
- Name — Enter a descriptive name (for example,
Frontegg Integration) - Supported account types — Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and then choose Allow all tenants so users from any Entra tenant can connect
- Redirect URI — Choose Web as the platform and enter your Frontegg redirect URL:
https://YOUR_MCP_GATEWAY_URL/integration-callback
Click Register to create the application.
After registration, the application Overview page opens. Copy the Application (client) ID — this is the Client ID you will paste into the Frontegg portal.
In the application's left sidebar, open API permissions and click + Add a permission. In the Microsoft APIs tab, choose Azure DevOps.
Choose Delegated permissions, then expand Other permissions and select user_impersonation. This grants the application access to Azure DevOps REST APIs on behalf of the signed-in user. Click Add permissions.
Granular vs. user_impersonation
Granular vs. user_impersonation
The Azure DevOps API tile also exposes granular vso.* scopes (for example, vso.code, vso.work, vso.build). The user_impersonation permission is the Microsoft-recommended option for new Entra ID OAuth apps and lets the integration request the specific granular scopes it needs at sign-in time.
The configured permissions list now shows Azure DevOps → user_impersonation alongside the default Microsoft Graph → User.Read permission.
In the application's left sidebar, open Certificates & secrets. Make sure the Client secrets tab is selected and click + New client secret.
Enter a description (for example, Frontegg Integration) and choose an expiration period. Click Add to create the secret.
Immediately copy the Value column of the new secret using the copy icon — this value is shown only once and cannot be retrieved later. Store it securely and paste it into the Frontegg portal as the Client Secret.
Copy the secret immediately
Copy the secret immediately
The client secret value is hidden as soon as you leave this page. If you lose it, you must delete the secret and create a new one.
Open Azure DevOps and select your organization. Open Organization settings → Overview — the organization slug is shown next to the Name field and in the URL https://dev.azure.com/{organization}/.
For example, in https://dev.azure.com/mycompany/, the organization slug is mycompany.
Once you have obtained your Application (client) ID, client secret value, and Azure DevOps organization slug from the steps above, enter them in the integration configuration page of the Frontegg portal:
- Open the Frontegg portal and navigate to [ENVIRONMENT] → Integrations → Azure DevOps.
- Enter the Application (client) ID as the Client ID and the client secret value as the Client Secret in the corresponding fields.
- Enter your Azure DevOps organization slug in the Azure DevOps organization field (for example,
mycompany). - Select the required scopes.
- Click Save.
Keep your credentials secure
Keep your credentials secure
Never share or commit your client secret to version control.