Azure DevOps

Connect an Azure DevOps project so agents can read repos, pull requests, and builds, and Review can comment on pull requests

Connect Azure DevOps and CloudThinker agents can read the repositories, pull requests, and builds in one project, and Review can post AI code reviews on pull requests. You authenticate with a personal access token (PAT): a token you create in Azure DevOps that acts with your account’s access, limited to the scopes you pick.

Prerequisites

• An Azure DevOps account with access to the organization and project you want agents to read.
• Your organization URL, for example https://dev.azure.com/acme, and the project name that holds your repositories.
• For Review: permission to create service hooks in the project (Project Settings → Service hooks).
• Permission to create a PAT. The connection accepts only a PAT, so if your organization’s policies restrict PAT creation, ask an Azure DevOps admin to allow one for the account you use.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Setup

1. Create a PAT in Azure DevOps

   Go to dev.azure.com/<org>, click the User settings icon (top right, next to your avatar), and choose Personal access tokens. Click New Token, select the organization, and set an expiration date. Azure DevOps defaults to 30 days and allows up to one year, so pick a date that matches your rotation policy. Choose Custom defined scopes:

   • Build: Read
   • Code: Read & Write
   • Pull Request Threads: Read & Write

   Click Create and copy the token now. Azure DevOps shows it only once.

2. Open the connection in CloudThinker

   In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Azure DevOps and click Connect.

3. Enter the connection details

   Fill in Organization URL, Project, and Personal Access Token from Connection details.

4. Validate and connect

   Click Validate PAT. CloudThinker shows Token works with the number of repositories in the project the token can reach. Then click Connect.

   Success state: CloudThinker shows Connected to Azure DevOps and Azure DevOps shows Connected on the Builtin Connections tab.

Add service hooks for Review

Azure DevOps doesn’t send pull request events to CloudThinker on its own. Agent questions work without service hooks, but Review needs them. The Review setup wizard shows the webhook URL and Secret token. Configure webhooks has the full click path.

Create one subscription per event under Project Settings → Service hooks → + Create subscription → Web Hooks:

Event	Needed for
Pull request created	Reviews (required)
Pull request updated	Reviews (required)
Pull request commented on	Mention commands. Set Resource version to 2.0
Build completed	Optional: pipeline analysis
Code pushed	Optional: only for Analyze new release tags

Connection details

Field	Description	Example
Organization URL	Your Azure DevOps organization URL	https://dev.azure.com/acme
Project	The project that holds your repositories, spelled as in Azure DevOps	Payments
Personal Access Token	The PAT you created, from the same organization as the URL	<your-pat>

One connection covers one project, and a workspace holds one Azure DevOps connection. Validation counts only repositories in that project.

Required permissions

Grant the PAT exactly these scopes:

Scope	Access	Why
Build	Read	Read build results and logs
Code	Read & Write	Read repositories, and create branches or pull requests through your Approvals
Pull Request Threads	Read & Write	Read review discussions and post Review comments

The PAT can never reach more than your own account can. Agent writes still pass through your Rules and Approval mode before anything changes.

Create the PAT from a dedicated service account that belongs only to the project CloudThinker should see. Give it the Basic access level, because Stakeholder access can’t use Repos. Review comments then come from that account, and no teammate’s token breaks when they leave.

Control access in CloudThinker

Two settings on the connection’s detail panel narrow what agents do. Open More → Workspace settings → Connections, select Azure DevOps, and look under Settings.

Setting	Options	What it does
Repository access	All or Selected	All lets agents read every repository the PAT reaches, including new ones. Selected limits agents to the repositories you pick, and new repositories stay excluded until you add them.
Allow writes	On (default) or off	On: agents can propose changes, and your Rules and Approval mode decide each one. Off: agents can only read, and every change is refused.

These settings only narrow what the PAT already grants. Choosing which repositories Review runs on is a separate step in Review setup.

Agent capabilities

Reads run without asking. Writes need Allow writes on and pass through your Rules and Approval mode first.

Capability	What agents can do
Repositories	List the project’s repositories and read their code and history
Pull requests	Summarize open pull requests, their reviewers, and discussion threads
Builds and pipelines	Find failed builds and read their logs to explain the failure
Changes	Comment, create branches, or open pull requests, through your Approvals

Verify the connection

List the Azure DevOps repositories you can reach and how many open pull requests each one has

A working connection names the real repositories in your project. If the list is empty, check the Project name.

Example prompts

Which open pull requests in the Payments project have had no reviewer vote for more than 3 days?
Why did the latest build on main fail for the web repository?
Summarize the pull requests completed into main this week

Troubleshooting

Validate PAT fails

The PAT is expired or revoked, lacks one of the three scopes, or belongs to a different organization than the Organization URL. Create a new PAT in the right organization with Build (Read), Code (Read & Write), and Pull Request Threads (Read & Write), then validate again.

Token works, but it shows zero repositories

The Project name doesn’t match a project the PAT’s account can see, or the project has no repositories. Copy the name from the project list in Azure DevOps and validate again.

Agents and Review stopped working after a few weeks

The PAT reached its expiration date (30 days unless you picked another). Create a new PAT with the same scopes. Then open Review → Settings, open the Connection actions menu (⋯) in the Connection section, and click Update token.

Connected, but Review doesn't comment on pull requests

One or more service hooks are missing. Azure DevOps needs a separate subscription per event. Check Project Settings → Service hooks against Configure webhooks.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Keep to the three scopes. Agents and Review need nothing beyond Build (Read), Code (Read & Write), and Pull Request Threads (Read & Write). Avoid Full access tokens.
• Rotate before expiry. Replace the PAT ahead of its expiration date so reviews don’t stop mid-sprint.

Related

Set Up Review

Choose repositories and start AI code reviews on pull requests

Provider Authentication

Add the Azure DevOps service hooks and compare other Git providers