Azure DevOps

Create a new Azure DevOps private repository using one of these options:

• Create a new repository
• Clone from the Honeydew quick-start example.

If you are restricting access to your Azure DevOps organization using IP addresses allow list, add the IP addresses displayed in the Azure DevOps connection screen in Honeydew App settings page to the relevant CAP (Conditional Access Policy) in Azure Portal (find more details here).

Please reach out to support@honeydew.ai and send the repository details: org name, project name, repository name (e.g. honeydew-data, quickstart, honeydew-quickstart).

Honeydew integrates with the Azure DevOps API through a service principal authentication, using a Microsoft Entra ID App.

Create an Entra ID App

1. Open the Azure Portal
2. In the search bar, search for App registrations. Open it and start a new registration by clicking New registration
3. On the Register an application page, enter the following details:
   • Name: Honeydew Azure DevOps Integration
   • Supported account types: Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)
     You need to select the Supported account types as Multitenant rather than Single Tenant, as Microsoft considers Azure DevOps (formerly called Visual Studio) and Microsoft Entra ID as separate tenants, and for the Entra ID application to work properly, you must select Multitenant.

   • Redirect URI: Leave blank
4. Click Register

Create a Client Secret

1. On the homepage of your newly created application, from the Overview screen, copy the values for the following fields and store them in a secure location:
   • Application (client) ID
   • Directory (tenant) ID
2. From the left menu of your newly created application page, open Manage > Certificates & secrets
3. Click New client secret
4. In the Add a client secret dialog, enter the following details:
   • Description: Honeydew Azure DevOps Integration
   • Expires: Choose an appropriate expiry date
5. Click Add
6. Copy the value of the newly created client secret and store it in a secure location

Create a Service Principal for the application

1. Open the Azure Portal
2. In the search bar, search for Microsoft Entra ID and select it from the drop-down list
3. In the left menu, expand the Manage section, and click App Registrations
4. Click on the application you created in the previous steps (e.g. Honeydew Azure DevOps Integration)
5. Locate the Managed application in local directory field, and click Create Service Principal. If the field is already populated, a service principal has already been assigned.

Add permissions to your service principal

1. Open the Azure Portal
2. In the search bar, search for Microsoft Entra ID and select it from the drop-down list
3. In the left menu, expand the Manage section, and click App Registrations
4. Click on the application you created in the previous steps (e.g. Honeydew Azure DevOps Integration)
5. Select API permissions in the left navigation panel
6. Remove the Microsoft Graph > User Read permission
7. Click Add a permission
8. Select Azure DevOps
9. Select the user_impersonation permission under Other permissions
10. Click Add permissions

1. From your Azure DevOps account organization screen, click Organization settings in the bottom left
2. Under General section, click Users
3. Click Add users, type the created service principal in the first field (e.g. Honeydew Azure DevOps Integration), and click the name as it appears.
4. In the Add to projects field, select the project that contains the Honeydew repository
5. Set the Azure DevOps Groups to Project Contributors

In the Honeydew application, go to Settings -> Azure DevOps and configure the following:

• Application (client) ID: Found in the Microsoft Entra ID app (see the app creation step).
• Directory (tenant) ID: Found in the Microsoft Entra ID app (see the app creation step).
• Client Secret: Use the secret value field from the secret you have created for the Microsoft Entra ID app in previous steps.