> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure DevOps

> Connect Azure DevOps to CloudThinker for repository, pull request, pipeline, and work item context, and to power Review

Connect your Azure DevOps project to let CloudThinker agents read repositories, pull requests, failing pipelines, and work items — and to run [Review](/guide/code-review/setup) on the repositories you select. Azure DevOps authenticates with a **personal access token (PAT)** scoped to one organization and project.

## Prerequisites

* An **Azure DevOps account** with access to the organization and project you want CloudThinker to reach.
* Permission to create a **personal access token** with the scopes listed below.
* Your **organization URL** (e.g. `https://dev.azure.com/myorg`) and the **project name** containing your repositories.

## Setup

<Steps>
  <Step title="Create a PAT in Azure DevOps">
    Go to `dev.azure.com/<org>` → **User settings → Personal access tokens** and click **New Token**:

    * **Build**: Read
    * **Code**: Read & Write
    * **Pull Request Threads**: Read & Write
    * **Expiration**: set a date (recommended)

    Copy the generated token immediately.
  </Step>

  <Step title="Enter the connection details">
    Navigate to **Connections → Azure DevOps** in your CloudThinker workspace, click **Connect**, and enter:

    * **Organization URL**: `https://dev.azure.com/myorg`
    * **Project**: the project name containing your repositories
    * **Personal Access Token**: the PAT you just created
  </Step>

  <Step title="Validate and connect">
    Click **Validate PAT** — CloudThinker confirms access and shows how many repositories the token reaches. Then click **Connect**. CloudThinker shows a **Connected** status.
  </Step>
</Steps>

<Note>
  Review needs one extra step on Azure DevOps: manual service hooks for pull request and build events. Follow [Configure webhooks](/guide/code-review/provider-auth#configure-webhooks).
</Note>

## Connection details

| Field                     | Description                               | Example                       |
| ------------------------- | ----------------------------------------- | ----------------------------- |
| **Organization URL**      | Azure DevOps organization URL             | `https://dev.azure.com/myorg` |
| **Project**               | Project name containing your repositories | `MyProject`                   |
| **Personal Access Token** | PAT with the scopes listed below          | —                             |

## Required permissions

Grant the PAT exactly three scopes:

| Scope                    | Access       |
| ------------------------ | ------------ |
| **Build**                | Read         |
| **Code**                 | Read & Write |
| **Pull Request Threads** | Read & Write |

Write operations such as comments, branch actions, and pull request changes additionally require explicit [approval](/guide/approval) in CloudThinker.

<Tip>
  Set an expiration date on the PAT and rotate it before it lapses — an expired PAT stops reviews and agent access until it is replaced.
</Tip>

## Repository access

On top of what the PAT can reach, the connection carries a CloudThinker-side repository policy. Open the connection's detail panel and find **Repository access** under **Settings**:

| Mode         | Behavior                                                                                                 |
| ------------ | -------------------------------------------------------------------------------------------------------- |
| **All**      | Every repository the PAT can reach is listed and readable; new repositories are included automatically   |
| **Selected** | Only the repositories you pick are listed and readable; new repositories are excluded until you add them |

The policy only ever narrows what the PAT already grants, and it is separate from choosing which repositories run [Review](/guide/code-review/setup). Switching from **Selected** to **All** and back restores your previous selection.

## Agent capabilities

Once connected, agents can:

| Capability        | Description                                                                |
| ----------------- | -------------------------------------------------------------------------- |
| **Repositories**  | List and inspect the project's repositories                                |
| **Pull requests** | Review open pull requests and their change discussions                     |
| **Pipelines**     | Investigate failing builds                                                 |
| **Work items**    | Read work items for delivery context                                       |
| **Changes**       | Comments, branch actions, and pull request changes — **requires approval** |

### Verify the connection

```text theme={null}
@alex list the Azure DevOps repositories CloudThinker can reach and summarize their open pull requests
```

### Example prompts

```text theme={null}
@alex #report which open pull requests in our Azure DevOps project are blocked
@alex #recommend a fix for the latest failed build on the web repository
@alex #report active work items and this week's merged pull requests
```

## Write access

Reads run without approval. Comments, branch actions, and pull request changes are approval-gated: CloudThinker states the effect and the exact inputs, then waits for your confirmation before touching the project.

## Troubleshooting

<Accordion title="PAT validation fails">
  The PAT is expired, lacks one of the three required scopes, or was created in a different organization than the URL you entered. Create a new token with **Build (Read)**, **Code (Read & Write)**, and **Pull Request Threads (Read & Write)** in the right organization, then validate again.
</Accordion>

<Accordion title="Validation shows zero repositories">
  The **Project** name does not match a project the PAT can reach. Check the spelling against the project list in Azure DevOps and confirm the token's account has access to it.
</Accordion>

<Accordion title="Reviews stopped after working previously">
  PATs expire on the date set at creation. Create a fresh PAT with the same scopes and update the connection's token in CloudThinker.
</Accordion>

<Accordion title="Reviews are not posting on pull requests">
  Azure DevOps requires manual service hooks for Review. Create them under **Project Settings → Service hooks** following [Configure webhooks](/guide/code-review/provider-auth#configure-webhooks).
</Accordion>

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Minimal scopes** — grant only Build (Read), Code (Read & Write), and Pull Request Threads (Read & Write); nothing else is needed.
- **Rotate before expiry** — replace the PAT ahead of its expiration date to avoid disrupting reviews.

## Related

<CardGroup cols={2}>
  <Card title="Review Setup" icon="gear" href="/guide/code-review/setup">
    Turn on automated AI code reviews for your Azure DevOps repositories
  </Card>

  <Card title="Provider Authentication" icon="key" href="/guide/code-review/provider-auth">
    Authentication and webhook details for every Review provider
  </Card>
</CardGroup>