Step-by-step deployment guide
The Azure Devops connector imports users, groups, projects, repositories and user specific permissions into Elimity Insights. Read up on the specifics and how to configure this connector below!
1. Which data is imported from Azure Devops?
The following Azure Devops metadata is imported:
UsersOrganization GroupsProject GroupsProjectsUser Specific Project PermissionsRepositoriesUser Specific Repository Permissions
The diagram below gives more information on the relationships between them:
User attributes
Each user entity has the following attributes:
domain
Azure AD tenant / domain the user belongs to.
mail_address
User's email address.
origin
Identity source (e.g. aad, msa).
principal_name
User's UPN / login name.
url
Direct link to the user in the Azure DevOps Graph API.
account_license_type
Azure DevOps license tier assigned to the user. Possible values: express (Basic), stakeholder, advanced (Basic + Test Plans), professional, earlyAdopter, none.
Other entities and their attributes can be inspected in the azure-devops-data-model.json below.
2. Creating a dedicated app registration in Entra ID
As usual we recommend creating a dedicated account for this connector. Follow the steps below to set up a new app registration in Entra ID:
In Azure, open the overview of your tenant's app registrations by typing 'app registrations' in the global search bar and clicking the 'App registrations' service.
Click the 'New registration' button.
Choose a name for this registration (e.g.
elimity-insights-azure-devops).Leave the default for 'Supported account types' and 'Redirect URI' and click 'Register'.
Note down these values:
Application (client) IDDirectory (tenant) ID
We'll need these later to configure the connection in Elimity.
3. Generating credentials for the new app registration
The Azure Devops connector authenticates as the app registration using a client secret. Click "Certificates & secrets" in the menu on the left and add a new client secret. Immediately note down the value of your new secret.
4. Retrieve your Azure Devops organization name
Get your Azure Devops organization name. You can find this as part of the URL of your Azure Devops tenant:
Example:
Azure DevOps URL:
https://dev.azure.com/your-organizationIn this case 'organization' would be
your-organization
5. Add the service principal to Azure Devops
Creating the app registration in Entra ID also creates a service principal. That service principal must be added to Azure DevOps as a user.
In Azure DevOps, go to "Organization Settings" → "Users" and click "Add Users"
Search for the service principal by the name of App Registration and add it.
Set the Access level to Basic.
Add the service principal to the Project Collection Valid Users group under "Organization Settings" → "Permissions" to ensure it can read all projects with its metadata.
5.1 (Optional but recommended) Grant the Member Entitlement Management scope
To import the account_license_type attribute (user license tier), the service principal also needs the Member Entitlement Management (read) scope.
Without this scope, the sync still completes successfully — license information will simply be absent from users, and the import logs will show a clear
ALERTexplaining the cause. You can skip this step and grant it later if you don't need license data right away.
To grant the scope:
In the Azure portal, open the App registration you created in step 2.
In the left menu, click API permissions → Add a permission.
Switch to the APIs my organization uses tab and search for Azure DevOps. Select it.
Choose Delegated permissions (or Application permissions if your tenant uses that pattern), then check
vso.memberentitlementmanagement(read user entitlements).Click Add permissions.
Back on the API permissions page, click Grant admin consent for [your tenant]. A tenant admin may need to do this if you don't have permission yourself.
Confirm the scope shows a green ✓ "Granted for [tenant]" status.
The next Azure DevOps sync in Elimity will then populate account_license_type on all licensed users.
6. Configure the source in Elimity Insights
Go to 'Sources' in the left navigation bar and click 'Add Source'.
Search for 'Custom' and click 'Set Up'
Click 'Set Up' again and fill in the name of the Source (e.g. Azure Devops)
Select 'Upload export file'
Click 'Continue' and upload the following file:
Now to the 'Config' tab and click 'Edit':

Set 'Enable automatic imports via custom gateway' to true and fill in the Gateway URL:
https://azure-devops-gateway-1027270379075.europe-west1.run.app
Now we need to add some configuration values. Click 'Add configuration value' and add the following configuration values:
clientId
Text
See step 2
clientSecret
Password
See step 3
tenantId
Text
See step 2
organization
Text
See step 4
The Azure Devops connector also supports 2 configuration values which allow to exclude or include certain projects. If both configuration values have been set,
includedProjectstakes precedence:
includedProjects
JSON
List of strings: ["Project1", "Project2"]
The integration will only import projects listed in this list.
excludedProjects
JSON
List of strings: ["ProjectX", "ProjectY"]
The integration will exclude mentioned projects during import.
Now click 'Save and run'! You can monitor the progress in the 'Logs' tab. Also the 'Imports' tab gives more information if anything went wrong.
7. Troubleshooting
account_license_type is missing for all users
The import logs will show an ALERT like:
Failed to fetch user entitlements (continuing without
account_license_type): 401 Unauthorized. Check that the service principal has thevso.memberentitlementmanagementscope.
Fix: grant the vso.memberentitlementmanagement (read) scope to the service principal in Azure (see step 5.1). On the next sync, the attribute will be populated.
account_license_type is missing for some users
This is expected because users without an assigned Azure DevOps license (deactivated accounts, guests, service accounts) don't appear in the entitlement API, so the attribute is simply absent for them. No action needed.
Last updated

