With the Azure DevOps integration, you can collect evidence from your Azure DevOps organization, including repository configurations, pipeline definitions, user access, project settings, and team memberships. This integration supports two collection methods — Script Runner and Terraform — so you can choose the approach that best fits what you're trying to collect. Both methods use the same authentication setup and support automated collection.

Read more about our Terraform integrations.

Important note: You do not need to use Terraform in your tech stack in order to use this integration.

Types of evidence you might collect

There are many different types of evidence you can collect from Azure DevOps. <a href="https://help.strikegraph.com/en/articles/15024407-script-runner-for-integrations" target="_blank">Script Runner makes it easy to collect common evidence types using pre-built scripts, and is just as powerful when used with custom scripts for more advanced needs. Terraform data blocks offer an alternative collection method using HCL, limited to the data sources supported by the Azure DevOps provider.

Here is a short, non-exhaustive list of some of the possible evidence you may collect from this integration:

• Repository configurations and branch policies

• Pipeline definitions and authorization settings

• User access lists, group memberships, and team configurations

• Project settings and environment configurations

• Service connection definitions

Setting up the integration

This integration authenticates using a Microsoft Entra service principal. To configure it, you (or someone in your organization) will need sufficient Azure and Azure DevOps permissions to create an app registration and grant it access to your Azure DevOps organization.

Prerequisites

1. An Azure DevOps organization

2. A Microsoft Entra tenant with permissions to create app registrations

3. Ability to grant admin consent for API permissions

Step 1: Create an App Registration in Microsoft Entra

Navigate to the Azure Portal and go to Microsoft Entra ID, then select App registrations and click New registration:

• Provide a meaningful name (e.g., "Strike Graph Terraform Integration")

• Select Accounts in this organizational directory only for supported account types

• Leave the Redirect URI blank

• Click Register

Note the Application (client) ID and Directory (tenant) ID — you'll need both when configuring the integration in Strike Graph.

Step 2: Create a Client Secret

In your newly created app registration:

1. Go to Certificates & secrets under the Manage section

2. Click New client secret

3. Provide a description and set an appropriate expiration period

4. Copy the client secret Value immediately — you will not be able to see it again

Step 3: Grant Access to Azure DevOps

The app registration needs to be authorized against your Azure DevOps organization. Navigate to your Azure DevOps organization and go to Organization Settings → Users:

1. Add the service principal as a user with at least Basic access level

2. Assign it to the projects relevant to the evidence you plan to collect

Note: The service principal needs sufficient read permissions within Azure DevOps for the data sources you intend to use. For most evidence collection, read-only project access is sufficient.

Step 4: Configure the Integration in Strike Graph

Navigate to the Integration Manager in Strike Graph and open the Terraform - Azure DevOps integration.

Note: If you do not see this integration listed, it may not be available for your organization or role yet — reach out to support or your Customer Success Manager to request access.

1. Click + Connect to begin configuring a new integration

2. Enter the following information:

   • Display Name: A meaningful label to identify this integration from others you may configure

   • Organization URL: Your Azure DevOps organization URL (e.g., https://dev.azure.com/your-org)

   • Microsoft Entra Tenant ID: Your Directory (tenant) ID, copied from Microsoft Entra

   • Application (client) ID: Copied from Microsoft Entra

   • Client secret: The client secret value you created in Step 2, copied from Microsoft Entra

3. Click Save

You can create multiple Azure DevOps connections as needed to manage different organizations or permission scopes. Everyone with access to your Strike Graph organization will be able to use any configured connections during evidence collection.

Collecting evidence

Once your integration is configured, navigate to the evidence item you want to collect for and click Attach Directly or Automated Collection. Select your Azure DevOps - Scripts & Terraform integration from the list of available integrations.

The evidence collection form has two tabs: Scripts and Terraform. Choose the method that works best for your needs.

Using Script Runner

The Scripts tab lets you collect evidence using Strike Graph's library of pre-built compliance collection scripts. No code required — just search, preview, and run.

1. Select the Scripts tab.

2. Use the search box to find a relevant script. The search is pre-populated with your evidence item's name as a starting point, but you can adjust as needed.

3. Browse the results. Each script card displays the script name, category, a short description, and the Azure DevOps services it targets.

4. Optionally, click Preview on any script card to review its full details and source code before running it.

5. Click Run to execute the collection.

Strike Graph will run the script and attach the results to your evidence item. Once finished, the modal will close and the collected data will appear as an attachment.

Writing custom scripts (Advanced)

If the pre-built scripts don't cover your needs, you can write your own Python script using the Advanced button at the top of the Scripts tab. Custom scripts must be read-only — write operations are blocked before execution.

Using Terraform Data Blocks

The Terraform tab lets you write your own HCL data blocks to collect from specific Azure DevOps data sources. This approach gives you the most flexibility and is well suited for evidence types that aren't covered by the available scripts.

Terraform integrations use "data blocks" to define what data to collect. More information about data blocks and local values can be found on the Terraform overview page. A full list of supported data sources is available at the bottom of this page and on the Terraform Azure DevOps provider page.

Step 1: Define the data block. Data blocks are extensible, but follow a typical pattern:

• data_source: Defines which Azure DevOps data source to read from. Terraform for Azure DevOps supports data collection from any resource with a supported data source from Terraform's Azure DevOps provider (see below for a list).

• temp_name: A temporary name you define, used to refer to this data block during execution. It only has labeling significance within the scope of this configuration. It is also used in the output's filename, so name it something recognizable. Names can be repeated across configurations, are limited to alphanumeric characters, and do not allow spaces.

• query constraints / arguments: Many data sources require specific arguments (like a project ID or repository name), or provide methods for constraining the data based on specific queries. These are written as key/value pairs. Refer to the specific data source requirements in the Terraform Azure DevOps provider documentation.

Step 2: Define the local values used for the execution. This follows a typical pattern derived from the data block: data.data_source.temp_name (sometimes followed by a key if a filter argument is desirable).

Run the data collection

After you have defined the data block and local values, click Attach to execute the data collection. This may take a few minutes as we set up the data pipeline to collect the attachment.

Once the collection is finished, the attachment modal will close and you can see the collected data has been added to the evidence. You can confirm what was collected by clicking on the attachment to view the data.

Automated Collection

It is highly recommended that you configure your evidence collection with automated collection. With Automated Collection, Strike Graph can recollect evidence attachments from Azure DevOps a few days before expiration so that your evidence remains in an effective audit-ready state.

To configure your evidence with Automated Collection, follow the steps above after clicking on the Automated Collection button found on the evidence item detail pages. Additional information about Automated Collection is available here.

Removing your Azure DevOps integration

You can remove the integration at any time. Please note that removing an integration does not delete any files that were attached using that integration. Removing an integration will also disrupt automated collection.

To remove:

1. Go to the Integrations Manager and click on the Terraform for Azure DevOps card to access the integration configurations

2. Click the Deactivate button next to your configuration

Note: You may have access to remove integrations for other users on your team.

If you are fully removing access between Strike Graph and your Azure DevOps organization, you may also wish to:

• Revoke the Personal Access Token from your Azure DevOps user settings

• Remove the service principal from your Azure DevOps organization (if applicable)

• Review and remove any project-level permissions granted during setup

Before making these changes, verify that you are not using the same credentials for other purposes.

Troubleshooting

For additional Terraform integration troubleshooting tips, click here.

Terraform integrations will return an error if we were unable to execute the collection request. The errors returned will differ depending on which step of the collection failed.

Authentication Errors

"Failed to acquire access token for Azure DevOps"

This error indicates that Strike Graph could not authenticate using the credentials provided. Check the following:

• Verify that your tenant ID, client ID, and client secret are all correct

• Check that the client secret has not expired — if it has, use the Reconnect button next to your integration to provide an updated secret

• Ensure the app registration exists and has not been deleted in Microsoft Entra

"Azure DevOps credential validation failed"

This error means authentication succeeded but the subsequent call to your Azure DevOps organization was rejected. Check the following:

• Verify that the organization URL is correct and uses HTTPS (e.g., https://dev.azure.com/your-org)

• Ensure the service principal has been added as a user in your Azure DevOps organization

• Check that the service principal has sufficient access to the projects you are trying to collect evidence from

General Configuration Errors

Invalid data source errors:

• Check that the resource you defined in data_source is available from the Azure DevOps Terraform provider

• Ensure that you have included any required query constraints/arguments

• Refer to the Azure DevOps provider documentation for specific requirements

Formatting errors:

• Check that your temp_name is formatted correctly (no spaces, only alphanumeric characters)

• Verify there are no unexpected characters or formatting issues in the data block or local values

• Confirm that the local values reference the correct data_source and temp_name

Duplicate integration errors:

• Each integration must have a unique display name within your organization

• If you receive an error about duplicate credentials, an existing integration is already using the same service principal — reuse that integration or create a new app registration with different credentials