> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure DevOps Connection

> Learn how to configure an Azure DevOps Connection for Infisical.

Infisical currently supports three methods for connecting to Azure DevOps, which are OAuth, Azure DevOps Personal Access Token and Client Secrets.

<Accordion title="Azure OAuth on a Self-Hosted Instance">
  Using the Azure DevOps <b>OAuth connection</b> on a self-hosted instance of Infisical requires configuring an application in Azure
  and registering your instance with it.

  **Prerequisites:**

  * Set up Azure.

  <Steps>
    <Step title="Create an application in Azure">
      Navigate to Azure Active Directory > App registrations to create a new application.

      <Info>
        Azure Active Directory is now Microsoft Entra ID.
      </Info>

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-aad.png" alt="Azure devops" />

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-new-app.png" alt="Azure devops" />

      Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/organization/app-connections/azure/oauth/callback`.

      <Tip>
        The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
      </Tip>

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/register-callback.png" alt="Azure devops" />
    </Step>

    <Step title="Assign API permissions to the application">
      For the Azure Connection to work with DevOps Pipelines, you need to assign the following permission to the application.

      #### Azure DevOps permissions

      Set the API permissions of the Azure application to include the following permissions:

      * Azure DevOps
        * `user_impersonation`
        * `vso.project_write`
        * `vso.variablegroups_manage`
        * `vso.variablegroups_write`

                <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-devops/app-api-permissions.png" alt="Azure devops" />
    </Step>

    <Step title="Add your application credentials to Infisical">
      Obtain the **Application (Client) ID** and **Directory (Tenant) ID** (this will be used later in the Infisical connection) in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/client-secrets/config-credentials-1.png" alt="Azure devops" />

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-credentials-2.png" alt="Azure devops" />

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-app-configuration/config-credentials-3.png" alt="Azure devops" />

      Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.

      * `INF_APP_CONNECTION_AZURE_DEVOPS_CLIENT_ID`: The **Application (Client) ID** of your Azure application.
      * `INF_APP_CONNECTION_AZURE_DEVOPS_CLIENT_SECRET`: The **Client Secret** of your Azure application.

      Once added, restart your Infisical instance and use the Azure Client Secrets connection.
    </Step>
  </Steps>
</Accordion>

<Accordion title="Azure DevOps personal access token (PAT)">
  #### Create a new Azure DevOps personal access token (PAT)

  When using the Azure DevOps <b>Access Token connection</b> you'll need to create a new personal access token (PAT) in order to authenticate Infisical with Azure DevOps.

  <Steps>
    <Step title="Navigate to Azure DevOps">
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-devops/overview-page.png" alt="integrations" />
    </Step>

    <Step title="Create a new token">
      Make sure the newly created token has Read/Write access to the Release scope.

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-devops/create-new-token.png" alt="integrations" />

      <Note>
        Please make sure that the token has access to the following scopes: Variable Groups *(read, create, & manage)*, Release *(read/write)*, Project and Team *(read)*, Service Connections *(read & query)*
      </Note>
    </Step>

    <Step title="Copy the new access token">
      Copy the newly created token as this will be used to authenticate Infisical with Azure DevOps.

      <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-devops/new-token-created.png" alt="integrations" />
    </Step>
  </Steps>
</Accordion>

<Accordion title="Client Secret Authentication">
  To use client secret authentication, ensure your Azure Service Principal has the required permissions and is connected to the Azure DevOps organization and projects you want to use.

  **Prerequisites:**

  * Set up Azure and have an existing Azure DevOps organization.
  * The service principal must be connected to your target Azure DevOps organization and project(s)

  <Steps>
    <Step title="Assign API permissions to the service principal">
      Configure the required API permissions for your App Registration to interact with Azure DevOps:

      #### Azure DevOps permissions

      Set the API permissions of your Azure service principal to include the following Azure DevOps permissions:

      * Azure DevOps
        * `user_impersonation`
        * `vso.project_write`
        * `vso.variablegroups_manage`
        * `vso.variablegroups_write`

                <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/azure-devops/app-api-permissions.png" alt="Azure devops" />

      <Note>If you want to configure automatic client secret rotation for this App Connection, you also need to grant either `Application.ReadWrite.OwnedBy` or `Application.ReadWrite.All` permissions.</Note>
    </Step>
  </Steps>
</Accordion>

## Setup Azure Connection in Infisical

<Steps>
  <Step title="Navigate to App Connections">
    Navigate to the **Integrations** tab in the desired project, then select **App Connections**. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png" alt="App Connections
    Tab" />
  </Step>

  <Step title="Add Connection">
    Select the **Azure Connection** option from the connection options modal. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/select-connection.png" alt="Select Azure Connection" />
  </Step>

  <Step title="Create Connection">
    <Tabs>
      <Tab title="OAuth">
        <Steps>
          <Step title="Fill in Connection Details">
            Fill in the **Tenant ID** field with the Directory (Tenant) ID you obtained in the previous [step](#azure-oauth-on-a-self-hosted-instance). Also fill in the organization name of the Azure DevOps organization you want to connect to.

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/fill-in-connection-details-oauth.png" alt="Fill in Connection Details" />

            <Tip>
              You can find the **Organization Name** on [https://dev.azure.com/](https://dev.azure.com/)
            </Tip>
          </Step>

          <Step title="Grant Access">
            You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
            you will be redirected back to Infisical's App Connections page. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/grant-access.png" alt="Azure Client Secrets
            Authorization" />
          </Step>
        </Steps>
      </Tab>

      <Tab title="Access Token">
        <Steps>
          <Step title="Fill in Connection Details">
            Fill in the **Access Token** field with the Access Token you obtained in the previous step. And the organization name of the Azure DevOps organization you want to connect to.

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/fill-in-connection-details-token.png" alt="Fill in Connection Details" />

            <Tip>
              You can find the **Organization Name** on [https://dev.azure.com/](https://dev.azure.com/)
            </Tip>
          </Step>
        </Steps>
      </Tab>

      <Tab title="Client Secret">
        <Steps>
          <Step title="Create Connection">
            Fill in the **Tenant ID**, **Client ID**, **Client Secret** and **Organization Name** fields with the Directory (Tenant) ID, Application (Client) ID, Client Secret and the organization name you obtained in the previous step.

            <Tip>
              You can find the **Organization Name** on [https://dev.azure.com/](https://dev.azure.com/)
            </Tip>

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/create-client-secrets-method.png" alt="Connect via Azure OAUth" />

            <Tip>
              You can optionally enable **Automatic Credential Rotation** for this connection. See the [Automatic Credential Rotation](#automatic-credential-rotation) section below for details.
            </Tip>
          </Step>
        </Steps>
      </Tab>
    </Tabs>
  </Step>

  <Step title="Connection Created">
    Your **Azure DevOps Connection** is now available for use. <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/devops-connection.png" alt="Azure DevOps" />
  </Step>
</Steps>

## Automatic Credential Rotation

When using the **Client Secret** authentication method, Infisical can automatically rotate the Client Secret of your Azure application on a recurring schedule. When enabled, Infisical will immediately generate a new Client Secret on connection creation and revoke the original one, ensuring that no external party retains access using the credentials you provided.

<Note>
  Automatic Credential Rotation is only available for the **Client Secret** authentication method.
</Note>

<Steps>
  <Step title="Locate the Key ID of your Client Secret">
    Before enabling rotation, you'll need the **Key ID** of the Client Secret you are using to authenticate. Navigate to your App Registration in the Azure Portal, then go to **Certificates & secrets**. Copy the **Secret ID** (Key ID) of the secret you are providing to Infisical.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/credential-rotation-key-id.png" alt="Azure Client Secret Key ID" />
  </Step>

  <Step title="Enable Automatic Credential Rotation">
    When creating or editing your connection, toggle on the **Automatic Credential Rotation** switch.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/credential-rotation-toggle.png" alt="Enable Automatic Credential Rotation" />
  </Step>

  <Step title="Provide the Client Secret Key ID">
    Enter the **Key ID** you copied in the previous step into the **Client Secret Key ID** field. Infisical uses this to revoke your original secret after generating a new one.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/credential-rotation-key-id-field.png" alt="Client Secret Key ID Field" />
  </Step>

  <Step title="Configure the Rotation Schedule">
    Set the **Rotation Interval** (in days) to define how often the credential should be rotated, and set **Rotate At** to the local time of day at which the rotation should occur.

    * **Rotation Interval** - How many days between each rotation.
    * **Rotate At** - The local time of day at which the rotation will be triggered.

          <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/azure/devops/credential-rotation-schedule.png" alt="Rotation Schedule" />
  </Step>
</Steps>