> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackone.com/llms.txt > Use this file to discover all available pages before exploring further. # Azure DevOps OAuth 2.0 (Microsoft Entra ID) connector profile – StackOne setup guide > Set up the OAuth 2.0 (Microsoft Entra ID) connector profile for Azure DevOps in StackOne. One-time admin setup required before your users can link Azure DevOps accounts via Hub. You need permission to register applications in your Microsoft Entra ID tenant, and administrator rights to grant admin consent. Note: end users cannot grant consent to newly registered multitenant apps without verified publishers.
Select Actions to adjust the guide
Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.
Action
Scope(s)
Loading actions...
Dynamic Guide URL
Scopes Selected

          

            
Separator

Register a Microsoft Entra ID application

Create an app registration in Microsoft Entra ID to enable OAuth 2.0 authentication with Azure DevOps.

Open the Microsoft Entra admin center and sign in with your Microsoft work account.

Microsoft sign in page with the Email, phone, or Skype field and Next button

In the left sidebar under Entra ID, click App registrations, then click + New registration in the toolbar.

App registrations list with the New registration button highlighted

On the Register an application screen, enter a Name (e.g., StackOne Azure DevOps Integration). Under Supported account types, open the dropdown and select Multiple Entra ID tenants (shown as Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)).

  • After selecting it, two options appear — select Allow all tenants (the default, Allow only certain tenants (Preview), requires listing every tenant explicitly).
Supported account types dropdown open with Multiple Entra ID tenants highlighted

Under Redirect URI (optional), select the Web platform and paste StackOne's callback URL, then click Register.

  • Redirect URI: `https://api.stackone.com/connect/oauth2/azuredevops/callback`
Completed Register an application form with the Register button highlighted

Configure API permissions

Grant the application delegated access to the Azure DevOps REST API.

In the app's left menu under Manage, click API permissions, then click + Add a permission in the Configured permissions section.

API permissions blade with the Add a permission button highlighted

In the Request API permissions panel, on the Microsoft APIs tab, select the Azure DevOps tile ("Integrate with Azure DevOps and Azure DevOps server").

Request API permissions panel with the Azure DevOps tile highlighted
Enables actions: Add Build Tag, Add Membership, Add Pull Request Label, Add User Entitlement, Add Work Item Comment, Create Build Definition, Create Classification Node, Create Dashboard Widget, Create Environment, Create Feed, Create Or Update Wiki Page, Create Pipeline, Create Policy Configuration, Create Project, Create Pull Request, Create Pull Request Reviewer, Create Pull Request Status, Create Pull Request Thread, Create Push, Create Query, Create Release, Create Release Definition, Create Repository, Create Service Endpoint, Create Service Hook, Create Team, Create Variable Group, Create Wiki, Create Work Item, Delete Classification Node, Delete Environment, Delete Policy Configuration, Delete Project, Delete Pull Request Reviewer, Delete Query, Delete Repository, Delete Service Endpoint, Delete Service Hook, Delete Team, Delete User Entitlement, Delete Variable Group, Delete Wiki, Delete Wiki Page, Delete Work Item, Delete Work Item Comment, Delete Work Item Tag, Download Attachment, Get Agent Pool, Get Backlog, Get Build, Get Build Changes, Get Build Definition, Get Build Log, Get Build Logs, Get Build Timeline, Get Build Work Items, Get Classification Nodes, Get Commit, Get Dashboard, Get Environment, Get Feed, Get Feed Permissions, Get Item, Get Iteration, Get Pipeline, Get Pipeline Artifact, Get Pipeline Log, Get Pipeline Run, Get Policy Configuration, Get Project, Get Project Properties, Get Pull Request, Get Pull Requests By Project, Get Query, Get Release, Get Repository, Get Service Endpoint, Get Subscription, Get Team, Get Tree, Get User, Get User Entitlement, Get Variable Group, Get Wiki, Get Wiki Page, Get Work Item, Get Work Item Comment, Get Work Item Tag, Get Work Item Type, List Agent Pools, List Agents, List Approvals, List Backlogs, List Boards, List Branch Statistics, List Build Artifacts, List Build Definitions, List Build Tags, List Builds, List Commits, List Dashboards, List Deployments, List Environment Deployment Records, List Environments, List Feeds, List Fields, List Forks, List Groups, List Items, List Iteration Work Items, List Iterations, List Memberships, List Merge Bases, List Pipeline Logs, List Pipeline Runs, List Pipelines, List Policy Configurations, List Policy Evaluations, List Projects, List Pull Request Commits, List Pull Request Iterations, List Pull Request Labels, List Pull Request Reviewers, List Pull Request Statuses, List Pull Request Threads, List Pull Request Work Items, List Pull Requests, List Pushes, List Queries, List Refs, List Release Definitions, List Releases, List Repositories, List Service Endpoints, List Service Hook Notifications, List Service Hooks, List Team Members, List Teams, List Test Plans, List Test Results, List Test Runs, List User Entitlements, List Users, List Variable Groups, List Widgets, List Wikis, List Work Item Comments, List Work Item Relation Types, List Work Item Revisions, List Work Item Tags, List Work Item Type Fields, List Work Item Types, List Work Item Updates, List Work Items By IDs, Preview Pipeline, Query Work Items (WIQL), Queue Build, Replace Service Hook, Run Pipeline, Search Code, Search Queries, Search Work Items, Set Feed Permissions, Set Project Properties, Update Approval, Update Classification Node, Update Environment, Update Feed, Update Policy Configuration, Update Project, Update Pull Request, Update Pull Request Reviewer, Update Pull Request Thread, Update Query, Update Refs, Update Repository, Update Service Endpoint, Update Team, Update User Entitlement, Update Variable Group, Update Wiki, Update Work Item, Update Work Item Comment, Update Work Item Tag, Upload Attachment

Under Delegated permissions, check user\_impersonation ("Have full access to Visual Studio Team Services REST APIs"), then click Add permissions. This single permission covers every Azure DevOps scope the connector uses:

  • The vso group in the same panel lists granular scopes, but the Service Hooks scopes (vso.hooks, vso.hooks\_write) needed for webhook events are not individually selectable there — user\_impersonation is the permission that covers them.
Delegated permissions list with user_impersonation checked and highlighted

Back on Configured permissions, click Grant admin consent for \[your tenant] and confirm with Yes, so users don't hit the unverified-publisher consent block.

Configured permissions with the Grant admin consent button highlighted

Create and copy your credentials

Copy the client ID and generate a client secret for the StackOne connection.

On the app's Overview page, in the Essentials panel, copy the Application (client) ID — this is the public identifier of your app. Paste it into the Client ID field in the StackOne Connector profile.

App Overview Essentials panel with the Application (client) ID highlighted

In the left menu under Manage, click Certificates & secrets. On the Client secrets tab, click + New client secret.

Certificates and secrets page with the New client secret button highlighted

In the Add a client secret panel, enter a Description, choose an expiry under Expires (default Recommended: 180 days (6 months)), and click Add.

  • Track the expiry date — the connection stops working when the secret expires and you will need to create a new one.
Add a client secret panel with Description and Expires fields and the Add button highlighted

Copy the new secret's Value column (not the Secret ID) and paste it into the Client Secret field in the StackOne Connector profile.

  • The secret Value is only displayed once and cannot be retrieved later — copy it before leaving the page.
  • Per the on-screen notice: "Client secret values cannot be viewed, except for immediately after creation. Be sure to save the secret when created before leaving the page."
Client secrets tab with the one-time secret Value highlighted and redacted

The Scopes field in the StackOne Connector profile is a space-separated list of Azure DevOps scopes to request. Leave it blank to use the default, which works with the user\_impersonation permission configured above.

  • Default: `https://app.vssps.visualstudio.com/.default`
## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Azure DevOps: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)
  • Click + Connector Profile
  • Search for and select Azure DevOps
  • Select Type as OAuth 2.0 (Microsoft Entra ID)
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
 Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Azure DevOps.