Reference

Authentication Azure App Credentials

Description

Use Azure AD service principal credentials (client id + secret) with the client credentials flow. Recommended for automated server-to-server access instead of PAT or delegated OAuth. [API reference]

Instructions

Step 1: Register the App in Microsoft Entra ID (AAD)

  1. Go to the Azure Portal > Microsoft Entra ID > App registrations and click New registration: Start new app registration in Microsoft Entra ID
  2. Name it (e.g., ZS-AzureDevOps-AppCred).
  3. Set Supported account types to "Accounts in this organizational directory only" (Single Tenant): Register app in Microsoft Entra ID
  4. Leave Redirect URI blank (it's not used for Client Credentials).
  5. Click Register.

Step 2: Create a Client Secret

  1. In your new app, go to Certificates & secrets.
  2. Click New client secret, give it a name, and set an expiration.
  3. Copy the Secret Value immediately. You will never see it again once you leave the page: Copy client Secret of Microsoft Entra ID app

Step 3: Set Permissions and Admin Consent

  1. Go to API permissions > Add a permission.
  2. Select Azure DevOps and click Delegated permissions.
  3. Check the necessary scopes (e.g., vso.project, vso.work_full).
  4. Crucial: Click Grant admin consent for [Your Tenant]. Without this, the app cannot authenticate in the background.

Step 4: Map the App to Azure DevOps Organization

  1. Copy your Application (client) ID from the App Overview page.
  2. Go to your Azure DevOps Organization Settings > Users.
  3. Click Add users, paste the Application (client) ID in the search box, and select the App.
  4. Assign an Access level (usually Basic) and add it to the relevant Projects.

Step 5: Connection Settings

In your SSIS package or ODBC data source, use the following in the App Credentials configuration:

  • In the Token URL field, paste the OAuth token endpoint (v2) URL from the Azure Portal 'Endpoints' tab.
  • In the Client ID field, paste the Application (client) ID.
  • In the Client Secret field, paste the Secret Value copied in Step 2.
  • In the Scope field, use: https://app.vssps.visualstudio.com/.default

Step 6: Finalize Connection

  1. Press Generate Token button to fetch the token using the Client Secret.
  2. Click Test Connection to confirm the setup.
  3. Done! You are ready to use the API Connector!

Parameters

Parameter Required Default value Options
Name: TokenUrl

Label: Token URL

 YES
Name Value
For Single Tenant https://login.microsoftonline.com/{ENTER-TENANT-ID-HERE}/oauth2/v2.0/token
For Multi Tenant https://login.microsoftonline.com/common/oauth2/v2.0/token
Name: ClientId

Label: Client ID

 YES
Name: ClientSecret

Label: Client Secret

 YES
Name: Scope

Label: Scopes (Use .default for App Credentials)

For App Credentials or Certificates, use the **.default** scope to automatically include all permissions granted and consented to in the Azure App Registration. Note: offline_access is not used in App-Only flows as refresh tokens are not required. 		YES https://app.vssps.visualstudio.com/.default
Name Value
App-Only Default (Recommended for AppCreds) https://app.vssps.visualstudio.com/.default
Project and team (read) https://app.vssps.visualstudio.com/vso.project
Project and team (read and write) https://app.vssps.visualstudio.com/vso.project_write
Project and team (read, write and manage) https://app.vssps.visualstudio.com/vso.project_manage
Work items (read) https://app.vssps.visualstudio.com/vso.work
Work items (read and write) https://app.vssps.visualstudio.com/vso.work_write
Work items (full) https://app.vssps.visualstudio.com/vso.work_full
Name: Organization

Label: Organization name or Id

The organization name or Id obtained from Azure DevOps. 		YES
Name: ApiVersion

Label: API Version

The version of the Azure DevOps API to use. 		YES 7.0
Name Value
6.0 6.0
7.0 7.0
7.0-preview 7.0-preview
7.1-preview.2 7.1-preview.2
Name: Project

Label: Default Project Name

The default project name to make API calls for.
Name: RetryMode

Label: RetryMode

 RetryWhenStatusCodeMatch
Name Value
None None
RetryAny RetryAny
RetryWhenStatusCodeMatch RetryWhenStatusCodeMatch
Name: RetryStatusCodeList

Label: RetryStatusCodeList

 429
Name: RetryCountMax

Label: RetryCountMax

 5
Name: RetryMultiplyWaitTime

Label: RetryMultiplyWaitTime

 True