Skip to main content
Connect your Azure DevOps project to let CloudThinker agents read repositories, pull requests, failing pipelines, and work items — and to run Review on the repositories you select. Azure DevOps authenticates with a personal access token (PAT) scoped to one organization and project.

​
Prerequisites

  • An Azure DevOps account with access to the organization and project you want CloudThinker to reach.
  • Permission to create a personal access token with the scopes listed below.
  • Your organization URL (e.g. https://dev.azure.com/myorg) and the project name containing your repositories.

​
Setup

1

Create a PAT in Azure DevOps

Go to dev.azure.com/<org> → User settings → Personal access tokens and click New Token:
  • Build: Read
  • Code: Read & Write
  • Pull Request Threads: Read & Write
  • Expiration: set a date (recommended)
Copy the generated token immediately.
2

Enter the connection details

Navigate to Connections → Azure DevOps in your CloudThinker workspace, click Connect, and enter:
  • Organization URL: https://dev.azure.com/myorg
  • Project: the project name containing your repositories
  • Personal Access Token: the PAT you just created
3

Validate and connect

Click Validate PAT — CloudThinker confirms access and shows how many repositories the token reaches. Then click Connect. CloudThinker shows a Connected status.
Review needs one extra step on Azure DevOps: manual service hooks for pull request and build events. Follow Configure webhooks.

​
Connection details

​
Required permissions

Grant the PAT exactly three scopes: Write operations such as comments, branch actions, and pull request changes additionally require explicit approval in CloudThinker.
Set an expiration date on the PAT and rotate it before it lapses — an expired PAT stops reviews and agent access until it is replaced.

​
Repository access

On top of what the PAT can reach, the connection carries a CloudThinker-side repository policy. Open the connection’s detail panel and find Repository access under Settings: The policy only ever narrows what the PAT already grants, and it is separate from choosing which repositories run Review. Switching from Selected to All and back restores your previous selection.

​
Agent capabilities

Once connected, agents can:

​
Verify the connection

​
Example prompts

​
Write access

Reads run without approval. Comments, branch actions, and pull request changes are approval-gated: CloudThinker states the effect and the exact inputs, then waits for your confirmation before touching the project.

​
Troubleshooting

The PAT is expired, lacks one of the three required scopes, or was created in a different organization than the URL you entered. Create a new token with Build (Read), Code (Read & Write), and Pull Request Threads (Read & Write) in the right organization, then validate again.
The Project name does not match a project the PAT can reach. Check the spelling against the project list in Azure DevOps and confirm the token’s account has access to it.
PATs expire on the date set at creation. Create a fresh PAT with the same scopes and update the connection’s token in CloudThinker.
Azure DevOps requires manual service hooks for Review. Create them under Project Settings → Service hooks following Configure webhooks.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Minimal scopes — grant only Build (Read), Code (Read & Write), and Pull Request Threads (Read & Write); nothing else is needed.
  • Rotate before expiry — replace the PAT ahead of its expiration date to avoid disrupting reviews.

Review Setup

Turn on automated AI code reviews for your Azure DevOps repositories

Provider Authentication

Authentication and webhook details for every Review provider