# Azure DevOps Configuration

## Create an Access Token in Azure DevOps

**Supported Azure DevOps Authentication**

For secure authentication with Azure DevOps, we strongly recommend using Personal Access Tokens (PATs). PATs offer more granular control and are the preferred method for integrations and automation. For more information, refer to the official [Azure DevOps documentation on Personal Access Tokens](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows).

Alternate credentials authentication (including username and password) was [fully deprecated in Azure DevOps in January 2024](https://devblogs.microsoft.com/devops/azure-devops-will-no-longer-support-alternate-credentials-authentication/). Personal Access Tokens are the required method for secure and continued access.

### Required Token Permissions

| Feature | Azure DevOps |
| --- | --- |
| [Automated Commit Feedback](https://help.sonatype.com/en/automated-commit-feedback.html "Automated Commit Feedback") | **Code: Read & Write** |
| [Automated Pull Requests](https://help.sonatype.com/en/automated-pull-requests.html "Automated remediation") | **Code: Read & Write** |
| [Pull Request Commenting](https://help.sonatype.com/en/pull-request-commenting.html "Pull Request Commenting") | **Code: Read & Write** |
| [Pull Request Line Commenting](https://help.sonatype.com/en/pull-request-commenting.html "Pull Request Commenting") | Not Applicable for AzureDevOps |
| [Bitbucket Code Insights](https://help.sonatype.com/en/bitbucket-code-insights.html "Bitbucket Code Insights") | Not Applicable for AzureDevOps |

To create a personal access token:

1. Log in to your organization in Azure DevOps

2. Open your user settings

3. Select **Personal access tokens** from the **User Settings** menu.

4. Click the **\+ New Token** button

|     |
| --- |
|  |

5. Name your token and select **All accessible organizations**. Choose an expiry date for your token.

**Warning**

Important! If you do not select **All accessible organizations**, the [Easy SCM Onboarding](https://help.sonatype.com/en/easy-scm-onboarding.html "Easy SCM Onboarding") feature will not work.

To enable automated pull requests and automated commit feedback:

1. Select the scopes for this token to authorize for your_specific tasks_. For the full features of IQ SCM support enable **Code: Read & Write** and then select **Create**.

|     |
| --- |
|  |

For Azure DevOps scopes details, refer to the [Azure DevOps documentation](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#scopes).

2. Save the personal access. You will not be able to view it again.

|     |
| --- |
|  |

## Protecting the Target Branch

You can prevent users from merging Pull Requests with failing IQ Policy Evaluations**.** IQ Policy Evaluations must be set to Fail at the Source Stage.

Create and configure a **Branch Policy** to protect your target branch:

1\. Navigate to **Repos → Branches** in the left menu, and select a branch to protect (typically main or develop). Select **Branch policies** from the menu.

|     |
| --- |
|  |

2\. Find **Status checks** and click the **+** button

3\. Fill out the form

**Status to check \*** → Security/IQ Policy Evaluation

**Policy requirement** → Required

**The rest of the values can use the default options**

|     |
| --- |
|  |

[See this page for more information on branch policy configuration.](https://docs.microsoft.com/en-us/azure/devops/repos/git/pr-status-policy?view=azure-devops)