Azure DevOps

Overview

The Azure DevOps integration connects your source code management and project tracking infrastructure to the Praetorian Guard Platform (PGP). It automatically discovers Git repositories across your Azure DevOps organization, imports them as assets in your attack surface inventory, and enables secret scanning to detect credentials committed to source code. Optionally, it also creates and syncs Work Items in Azure DevOps from PGP risk findings.

---

What the Integration Does

The integration has two independent capabilities that can be configured separately:

Repository Discovery and Secret Scanning

PGP enumerates all projects and Git repositories within your Azure DevOps organization (or a specific project, if scoped). Forked and disabled repositories are automatically filtered out. Each discovered repository is tracked as an asset in your PGP attack surface inventory.

Once discovered, repositories are automatically scanned by PGP's security capabilities:

• Titus (github.com/praetorian-inc/titus) — Praetorian's credential detection engine. Titus scans both current source code and Git commit history, so secrets that were committed and later removed are still detected. Runs automatically on all discovered repositories.
• Constantine — LLM-powered source code vulnerability analysis that identifies application-level security issues. Available on demand for specific repositories.

This capability is read-only — PGP clones and scans repositories but never modifies code, branches, or settings in Azure DevOps.

You can scope the integration at two levels:

• Organization-wide: https://dev.azure.com/{org} — scans all projects and their repositories
• Single project: https://dev.azure.com/{org}/{project} — scans only repositories in that project

A repository URL such as https://dev.azure.com/{org}/{project}/_git/{repo} is accepted, but PGP scans every repository in that project; the repository name does not narrow the scan.

The integration supports Azure DevOps Services (dev.azure.com) only. Azure DevOps Server and Team Foundation Server (TFS) are not supported.

PGP imports repositories only. Organization and project members are not imported, and repositories in public projects are not yet marked as public in PGP.

Fix Pull Requests

When Constantine finds a vulnerability, it generates a validated patch. For Azure DevOps repositories, the patch is shown on the risk in PGP, and you can review it and click Copy diff to apply it yourself. PGP cannot open pull requests in Azure DevOps. Opening a pull request from PGP is available only for GitHub repositories.

Webhooks and Service Hooks

Repository scanning does not use webhooks or Azure DevOps service hooks, and you do not need to configure any. Each run re-enumerates the configured scope, so PGP finds new repositories on the next run.

Work Item Tracking (Optional, Separate Integration)

PGP can create Azure DevOps Work Items (Bugs, Tasks, Issues, or any type supported by your project) from discovered risks. Each work item includes the risk name, a rich HTML description with a link back to PGP, impacted assets, evidence, proof artifacts, and a severity mapping:

You can configure templates with different projects and work item types, enable auto-creation above a severity threshold, and PGP will sync work item status (Active, Resolved, Closed, Done) back automatically.

This capability is read-write — PGP creates and updates Work Items in your Azure DevOps projects.

---

Prerequisites

Before setting up the integration, you need:

• An Azure DevOps organization accessible at https://dev.azure.com/{org}
• Authentication credentials — either an Azure cloud integration (Entra ID) or a Personal Access Token (PAT)
• Network connectivity between PGP and Azure DevOps

Authentication Methods

PGP supports two authentication methods for Azure DevOps. Both are available for repository scanning and work item tracking.

Azure Cloud Integration (Recommended)

Uses your existing Azure cloud integration with Entra ID (formerly Azure AD) for automatic token rotation. PGP performs an OAuth token exchange using the service principal from your Azure integration. Credentials are managed through Azure's identity platform and rotated automatically.

Setup requirement: The service principal must be added as a user in Azure DevOps and granted access to each project you want PGP to see. Go to Organization Settings > Users, add the Application ID (from your Terraform output), and grant Basic access level. Then open Manage access for the user and check the box for every project PGP should access — adding the user at the organization level alone does not grant project visibility. For repository scanning use Project Readers; for work item tracking use Project Contributors.

Personal Access Token (PAT)

Uses a static PAT for authentication. PATs are long-lived static credentials that must be rotated manually.

Required PAT scopes:

To create a PAT: In Azure DevOps, click your profile icon > Personal access tokens > + New Token. Select the required scopes and set an expiration. For details, see Microsoft's PAT documentation.

The PAT owner must also be a member of every project you want PGP to access. Open Organization Settings > Users, click the user, and use Manage access to check each project. A PAT only grants the permissions its owner already has — if the user can't see a project in the Azure DevOps UI, PGP can't either.

---

Setup

Repository Scanning

Via Azure Cloud Integration

1. Ensure you have an existing Azure cloud integration configured in PGP.
2. Add the service principal to Azure DevOps: go to your Azure DevOps organization Organization Settings > Users. Add the Application ID and grant Basic access.
3. Grant project access: still in Organization Settings > Users, click the service principal and open Manage access. Check the box next to every project you want PGP to scan and assign it to the Project Readers group. Without this step, PGP authenticates successfully but sees zero projects.
4. In PGP, navigate to Integrations > Source Code Managers > Azure DevOps.

5. Click Connect. PGP validates access by listing projects in your organization.

Via PAT

1. In PGP, navigate to Integrations > Source Code Managers > Azure DevOps and click Use alternative authentication.

2. Click Connect. PGP validates the PAT by listing projects.

Work Item Tracking

Via Azure Cloud Integration

1. In PGP, navigate to Integrations > IT Service Management > Azure DevOps Work Items.

2. Click Connect, then configure a template:

• Select a Project from the dropdown (populated dynamically)
• Select a Work Item Type (Bug, Task, Issue, etc. — populated based on project)
• Optionally enable auto-create with a severity threshold

Via PAT

1. In PGP, navigate to Integrations > IT Service Management > Azure DevOps Work Items and click Use alternative authentication.

2. Click Connect, then configure a template (same as above).

---

What Data Is Synced

Repositories to PGP Assets (Read-Only)

• All active, non-fork Git repositories in the configured scope are imported as repository assets
• Each asset is identified by the repository's web URL
• Forked and disabled repositories are automatically excluded
• Each run re-enumerates the configured scope, so new repositories are imported on the next run
• Repositories run up to 25 concurrent scan operations per project

Work Items from PGP Risks (Read-Write)

• PGP creates Work Items in the configured Azure DevOps project from risk findings
• Work items include: title, rich HTML description, severity, impacted assets, evidence, proof artifacts, and a link back to PGP
• PGP syncs work item status back: Active, Resolved, Closed, and Done states are tracked
• PGP adds a comment to the work item when the risk's severity changes
• Multiple templates can be configured for different projects and work item types

---

Azure DevOps API Endpoints Used

Repository Scanning

Work Item Tracking

All endpoints use API version 7.1 (comments use 7.1-preview.4).

---

Troubleshooting

---

Security and Data Handling

• Repository scanning is read-only — PGP clones repositories for scanning but never pushes code, creates branches, or modifies any repository settings
• Work item tracking is read-write — PGP creates and updates Work Items in your configured projects
• When using Entra ID authentication, credentials are automatically rotated through Azure's identity platform — no static secrets are stored
• PAT credentials are encrypted at rest and in transit within your PGP deployment
• Only repository metadata (names, URLs, branches) and work item fields are accessed — PGP does not access Azure DevOps pipelines, build artifacts, or organization settings beyond what is needed for discovery and ticketing
• PGP uses up to 25 concurrent connections per project during repository enumeration

---

Best Practices

• Prefer the Azure Cloud Integration over PAT for automatic credential rotation
• Use project-scoped URLs if you only need to monitor specific projects rather than the entire organization
• Use a service account for PATs so the integration is not disrupted by personnel changes
• Set short PAT expiration and rotate regularly if using PAT authentication

---

Integration category: Source Code Managers / IT Service Management. Data direction: Read-only (repositories), Read-write (work items). Authentication: Azure Entra ID (recommended) or Personal Access Token.