Azure DevOps
The Azure DevOps connector lets an owner or admin sign in with Microsoft once, so the trusted publisher form can list your Azure DevOps organisations, projects and pipelines. You choose from lists instead of typing names and looking up a pipeline id.
TL;DR
| Question | Answer |
|---|---|
| What does it do? | Fills the Azure Pipelines trusted publisher form with lists: organisation, then project, then pipeline by folder with its id. Branch suggests the pipeline's default branch and stays free text. |
| Which plan? | Pro and Enterprise, the plans with trusted publishers. Disconnecting works on any plan. |
| Who connects it? | The owner and the admins, signed in, under Connectors, Azure DevOps. |
| Which account? | A Microsoft work or school account (Microsoft Entra ID) that can see the pipelines. A personal Microsoft account cannot sign in to it. |
| What does Plotwork read? | The organisations the account belongs to, project and pipeline names and ids, and a pipeline's repository name and default branch. Read only, when the form asks. |
| What does Plotwork keep? | Microsoft's refresh token, sealed with your organisation's own key, and the account's name to show who connected. Nothing it reads is stored. |
| Is it needed? | No. Without it, or when a list cannot be read, the form takes typed ids as before. |
| Is it recorded? | Yes. Connecting and disconnecting are in the organisation's audit log, never with a token. |
1. Connect
- Open the organisation in the portal, choose Connectors, and open Azure DevOps.
- Choose Connect with Microsoft and sign in with a work or school account that can see your Azure DevOps organisations.
- Accept the permissions. Plotwork asks to read your profile, projects and pipelines, and to stay signed in.
- Microsoft sends you back to the Azure DevOps page, which shows the account, who connected it and when.
If your Microsoft tenant only lets an administrator approve new apps, the page says so. Ask your Entra ID administrator to grant consent to Plotwork, then connect again.
2. Add a trusted publisher from lists
- Choose Add a trusted publisher on the Azure DevOps page, or open Keys & CI, CI/CD, and choose Add trusted publisher.
- Choose Azure Pipelines.
- Choose the organisation, then the project, then the pipeline. Pipelines are grouped by folder, each with its id after its name.
- Branch suggests the pipeline's default branch. Take it, type another, or leave it blank for any branch.
- Choose what its runs can do, and save.
Type the ids instead switches to the typed fields at any time. Editing an entry keeps its own organisation, project and pipeline, even when the account cannot see them.
3. What Plotwork reads and keeps
| Item | Read | Kept |
|---|---|---|
| Organisations the account belongs to | Names and ids, when the form opens | No |
| Projects and pipelines | Names, ids and folders, when one is chosen | No |
| A pipeline's repository | Its name and default branch, when the pipeline is chosen | No |
| The sign-in | Microsoft's refresh token, sealed with your organisation's own key, never shown | |
| Who connected | The Microsoft account's address or name, the Plotwork member and the time |
An access token is made from the refresh token when a list is read, and kept in memory for five minutes at most. Plotwork never writes to Azure DevOps. The refresh token is protected the same way as an email connector's token; see How your token is protected.
How Plotwork's Microsoft app proves itself
Plotwork's Entra app has no client secret from Microsoft to leak or expire. Each time Plotwork exchanges your sign-in's code or refreshes it, it sends a short signed statement instead (a client assertion, valid five minutes), and the app's federated identity credential tells Microsoft to trust it.
| Value | What it is |
|---|---|
| Issuer | https://api.plotwork.dev/connectors/oidc, Plotwork's own OpenID Connect issuer for this app. Its public keys are at https://api.plotwork.dev/connectors/oidc/jwks.json. |
| Subject | plotwork-azure-devops-connector |
| Audience | api://AzureADTokenExchange |
The signing key's private half is sealed on Plotwork's servers and never leaves them. This changes nothing in your tenant: you consent to the same app, with the same read-only permissions.
4. Disconnect
Choose Disconnect on the Azure DevOps page. The sealed sign-in is destroyed at once and the form goes back to typed ids. Trusted publishers already added keep working: a pipeline signs in with its own token, not with this connector.
To revoke Plotwork at Microsoft too, remove it under My Apps at myapps.microsoft.com, or ask your Entra ID administrator to remove its enterprise application.
5. Troubleshooting
| What the page or form says | What to do |
|---|---|
| Not set up on this server | This Plotwork server has no Microsoft app for the connector. Type the ids. |
| Asks an administrator to approve Plotwork first | Your tenant requires admin consent. Ask your Entra ID administrator, then connect again. |
| The sign-in has expired or was revoked | Connect again. Microsoft ends a sign-in after long disuse, a password reset or a revocation. |
| Cannot read that organisation or project | The account that connected is not a member of it. Connect with an account that is, or type the ids. |
| Azure DevOps lists could not be read | The form keeps the typed fields. Check the connector, or try again later. |
| Microsoft refused this server's credential | Microsoft did not accept Plotwork's own app credential, which no setting of yours causes. Try again later, or contact support. |
Audit events
| Action | When | Details |
|---|---|---|
orgs.connector.azure_devops_connect | Azure DevOps is connected | Whether it replaced an earlier sign-in |
orgs.connector.azure_devops_disconnect | Azure DevOps is disconnected | None |
See also
| Page | Why |
|---|---|
| Trusted publishers | What a trusted publisher is and what is checked |
| Diagrams in Azure Pipelines | The extension's task, and signing in with no key |
| How your token is protected | The organisation's own key |
| Connectors | Every connector |