Connect Azure DevOps

The Workspace reads your Azure DevOps organization with a Personal Access Token (PAT). With it, Leavory maps projects, repositories, pipelines, members and service connections.

Leavory only reads. Every call is a read: no write scope is needed, and Leavory doesn’t change code, pipelines or permissions.

Minimum PAT scopes

When creating the PAT, choose Custom defined and check only these five scopes, all set to Read:

Scope (as shown in Azure DevOps)	What Leavory reads with it
Project and Team → Read	The organization’s list of projects
Code → Read	Repositories, files (Dockerfile, package manifests) and branch policies
Build → Read	Pipelines, runs and build artifacts (such as the scan report)
Graph → Read	Groups and members of each project, for the access inventory
Service Connections → Read	The list of each project’s service connections, without their secrets

Don’t use Full access

A PAT with Full access works, but it gives the token far more power than Leavory needs. If it leaks, whoever holds it can change code and pipelines. Always use Custom defined with the five scopes above.

Create the PAT

1. In Azure DevOps, click the User settings icon (top right) → Personal access tokens.

2. Click + New Token and fill in:

   Field	Value
   Name	leavory-workspace
   Organization	only the organization Leavory will read (don’t use All accessible organizations)
   Expiration	whatever your company policy allows. Note the date so you can rotate it in time
   Scopes	Custom defined → the five scopes, all set to Read

   To see the Graph and Service Connections scopes, click Show all scopes at the bottom of the list.

3. Click Create and copy the token right away. Azure DevOps doesn’t show the value again.

Which user should create the PAT

The PAT sees only what the user who created it can see. Projects that user isn’t a member of are left out of Leavory.

Ideally, use a dedicated service account with:

• Basic access level in the organization;
• the Readers group in each project Leavory should map.

That way the inventory doesn’t depend on one person’s account, and access doesn’t change when someone switches teams or leaves the company.

Set it up in the Workspace

1. In the Workspace, open Settings → Azure DevOps tab.

2. Fill in Organization (the name in dev.azure.com/<organization>) and Access token (PAT).

3. Click Test connection. Leavory tests each scope and shows the result:

   Check	Scope tested
   Organization and projects	Project and Team (Read)
   Repositories	Code (Read)
   Pipelines and builds	Build (Read)
   Service connections	Service Connections (Read)
   Project members	Graph (Read)

4. With every check passing, click Save.

The test doesn’t save anything. With a PAT already saved, leaving the field blank tests the saved one.

Test messages

Message	What to do
Missing permission: <scope>	Edit the PAT in Azure DevOps and check the scope shown, set to Read
The access token was rejected (invalid, expired, or not valid for this organization)	Wrong token, expired, or created for another organization. Create a new one
Organization "<name>" was not found on dev.azure.com	Check the organization name
Token accepted, but it cannot see any project in this organization	The PAT user isn’t a member of any project. Add them as a Reader
Could not reach Azure DevOps from Leavory	Temporary network failure. Try again in a few minutes

Rotate the PAT

Azure DevOps PATs always expire. Before the expiration date:

1. Create a new PAT with the same scopes (or use Regenerate on the current PAT).
2. In Settings → Azure DevOps, paste the new token, click Test connection and then Save.
3. Revoke the old PAT in Azure DevOps, if it wasn’t regenerated.