Azure DevOps
Connect Azure DevOps to Airia through the MCP Gateway with your own Microsoft Entra app registration, so agents can work with projects, work items, repositories, pull requests, pipelines, and wikis.
The Azure DevOps server connects your Azure DevOps organization to Airia agents and MCP clients. Agents can read and update work items, browse repositories and pull requests, check pipeline runs, and search wikis, all as the person who signed in and within the access that person already has in Azure DevOps.
Azure DevOps connects with a Microsoft Entra app registration that you own. You register the app once in your Entra tenant, grant admin consent, and enter its details in Airia. Each person who connects then signs in with their own work account.
This page covers connecting Azure DevOps as an MCP server, so agents can act on your Azure DevOps data. To discover the AI agents and assets that live in your Azure DevOps repositories, see Azure DevOps discovery.
What It Can Do
| Area | Example tools |
|---|---|
| Projects and teams | core_list_projects, core_list_project_teams |
| Work items and boards | wit_work_item, wit_work_item_write, wit_query, wit_backlog, wit_work_item_comment_write, work_iteration_write |
| Repositories and pull requests | repo_repository, repo_file, repo_branch, repo_pull_request, repo_pull_request_thread_write, repo_search_commits |
| Pipelines | pipelines_definition, pipelines_build, pipelines_build_log, pipelines_run, pipelines_artifact |
| Wikis and search | wiki, wiki_upsert_page, search_code, search_wiki, search_workitem |
| Test plans | testplan, testplan_test_run, testplan_show_test_results_from_build_id |
To limit what agents can do, choose which tools the Gateway exposes when you configure it.
Before You Start
- An Azure DevOps organization connected to Microsoft Entra ID. In Azure DevOps, go to Organization settings → Microsoft Entra and confirm the organization is connected to the directory you'll register the app in. People sign in with work or school accounts from that directory.
- An Entra role that can grant admin consent, such as Global Administrator, Privileged Role Administrator, or Cloud Application Administrator.
- Airia permissions. Creating a Gateway and adding the server to it needs MCP → Static Gateways → Manage. Making the Gateway visible to everyone in your organization also needs MCP → Gateway/Toolkit Assignment → Manage. Sharing the app registration at the Tenant level needs MCP → Non-Personal Credentials → Manage, and approving the server for your organization needs MCP → App Management → Manage. Each person who connects their own account needs MCP → Dynamic Gateway → Use. See the permissions reference.
Register an App in Microsoft Entra ID
Go to Microsoft Entra ID app registrations and click New registration.
Give the app a name, for example Airia Azure DevOps, and choose who can sign in (see Account Types below; single tenant is recommended for most organizations). Under Redirect URI, select Web and enter:
https://auth.airia.ai/OAuth/callbackThen click Register.
Go to API permissions → Add a permission → APIs my organization uses, and search for Azure DevOps MCP or its application ID:
2a72489c-aab2-4b65-b93a-a91edccf33b8Select it, choose Delegated permissions, check Ado.Mcp.Tools, and click Add permissions.
Still on the API permissions page, click Grant admin consent for [your organization] and confirm. The Status column shows a green check next to Ado.Mcp.Tools when consent is in place.
Go to Certificates & secrets → New client secret, choose an expiry, and copy the Value immediately. Azure only shows it once.
From the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
If Azure DevOps MCP isn't listed under APIs my organization uses, your directory hasn't used it yet. Run the following in Azure Cloud Shell as an administrator, then search again:
az ad sp create --id 2a72489c-aab2-4b65-b93a-a91edccf33b8Account Types
Azure DevOps signs people in with work or school accounts, so choose one of the two organizational options when you register the app. Each one expects a different Microsoft Entra ID tenant identifier value in Airia:
| Account type | Microsoft Entra ID tenant identifier |
|---|---|
| Accounts in this organizational directory only (single tenant) | Your Directory (tenant) ID, or your verified domain such as contoso.onmicrosoft.com |
| Accounts in any organizational directory (multitenant) | organizations |
Single tenant is recommended if you want to restrict sign-in to people in your own organization.
Add Azure DevOps in Airia
To make Azure DevOps available to everyone in your organization, approve it in App Management.
Go to MCP → Static Gateways. Click Create Gateway, or Configure on an existing Gateway, and add Azure DevOps from the server catalog.
Fill in the connection fields:
| Field | Value |
|---|---|
| Client ID | The Application (client) ID you copied. |
| Client Secret | The secret Value you copied. |
| Azure DevOps organization name | The name in your organization's URL. For https://dev.azure.com/contoso, enter contoso. |
| Microsoft Entra ID tenant identifier | The value from Account Types that matches your app registration. |
| OAuth Scopes | Keep the default value. |
On the Gateway, the Azure DevOps row shows Needs Authentication. Click Authenticate and sign in with your work account. Airia returns you to the Gateway when the connection completes.
Because the app registration belongs to your organization, the Client ID and Client Secret can be shared at the Tenant level, so this setup happens once. Each person who connects still signs in with their own account and sees only the projects, repositories, and work items they can already access in Azure DevOps. See Tenant vs. Personal Level App Credentials.
Test the Connection
On the Gateway, the Azure DevOps row no longer shows Needs Authentication, and the Gateway's tool list includes the Azure DevOps tools from What It Can Do.
From an agent or MCP client that uses the Gateway, try a read-only prompt such as:
List the projects in my Azure DevOps organization, then show the active work items assigned to me.The answer reflects the projects and work items you see in Azure DevOps.