Skip to main content
Table of Contents

Connect Azure Repos to LinearB

Connect Azure Repos to LinearB using a Personal Access Token (PAT) to sync repositories and Git activity.

Steven Silverstone
Updated by Steven Silverstone
Table of Contents

Connect Azure Repos (Azure DevOps) to LinearB using OAuth 2.0 or a Personal Access Token (PAT) to collect repository activity and calculate delivery metrics.

Summary

What this guide covers

  • Connecting with OAuth 2.0 (open beta / available on request)
  • Creating a Personal Access Token (PAT) in Azure DevOps
  • Configuring Service Hooks permissions
  • Connecting Azure Repos to LinearB using your organization name and PAT
  • Verifying the connection, reauthorizing, and troubleshooting
Firewall requirements

If your organization uses firewall rules, IP allowlists, or geolocation-based conditional access policies, ensure that communication with LinearB is allowed.

LinearB uses the following NAT Gateway IP addresses for Azure DevOps and Azure Repos connections:

  • Inbound: 18.118.232.229, 52.15.80.85
  • Outbound: 35.226.140.92

If your organization restricts access based on IP address or geographic location, ensure these addresses are allowlisted before attempting to connect or reauthorize Azure DevOps.

Before you begin

  • Azure DevOps account with Organization Owner or Project Collection Administrator permissions
  • LinearB Admin role
  • Access to the Azure DevOps organizations, projects, and repositories you want to connect
  • Project-level View subscriptions and Edit subscriptions permissions for Service Hooks in the relevant projects
  • For PAT: Permission to create a Personal Access Token in Azure DevOps
  • For OAuth: A Microsoft Entra work account and OAuth beta access enabled for your LinearB organization. Personal Microsoft accounts are not supported for OAuth.

Choose an authentication method

  • OAuth 2.0: Authorize through Microsoft using a Microsoft Entra work account. One connection covers the Azure DevOps organizations that the authorizing user can access. You do not enter an organization name.
  • PAT: Create a token and enter it with your Azure DevOps organization name. The PAT connection covers one organization.

OAuth 2.0 — Open beta / available on request

OAuth is enabled on request for your LinearB organization. If the OAuth option is not visible, contact LinearB Support to request access.

Configure Service Hooks permissions

LinearB uses Azure DevOps Service Hooks to receive notifications about repository activity, including commits and pull requests. This requirement applies to both authentication methods.

  1. In Azure DevOps, open the relevant project.
  2. Go to Project Settings → Service hooks.
  3. Open the Service Hooks security settings.
  4. Ensure the integration account has View subscriptions and Edit subscriptions permissions.
  5. Repeat for each relevant project.

Important: These are project-level permissions, not PAT scopes. No additional Service Hooks PAT scope is required. For OAuth, PR webhook management uses vso.code, and the authorizing user still needs these project-level permissions.

Connect using OAuth 2.0

Open beta / available on request. Ensure OAuth access is enabled for your LinearB organization before starting.

  1. In LinearB, go to Settings → Company Settings → Git.
  2. Click Add Integration and select Azure DevOps.
  3. Use the OAuth option under Connect as an Admin and click Authorize Azure DevOps.
  4. You are redirected to Microsoft. Sign in with the Microsoft Entra work account that has access to the required Azure DevOps organizations.
  5. Review and accept the requested permissions if Microsoft displays the consent screen.
  6. You are redirected back to LinearB, where the integration is created and repository discovery begins.

Microsoft remembers consent, so later connections may skip the consent screen. OAuth does not require an organization name or an organization selection step.

OAuth permissions

LinearB requests the following Azure DevOps scopes:

  • Code: vso.code
  • Build: vso.build
  • Graph: vso.graph
  • Project and Team: vso.project

OAuth also requests offline_access, openid, and profile for continued access and sign-in. These are requested automatically; you do not create or configure a PAT for OAuth.

Connect using a Personal Access Token (PAT)

Follow these steps to connect one Azure DevOps organization using a PAT.

Step 1. Generate a Personal Access Token in Azure DevOps

To connect Azure Repos, create a Personal Access Token (PAT) in Azure DevOps:

  1. Sign in to Azure DevOps.
  2. Open User Settings (top-right) and select Personal Access Tokens.
  3. Click + New Token.
  4. Enter a descriptive name.
  5. Set an appropriate expiration date.
  6. Assign the following permissions:
    • User Profile: Read (vso.profile)
    • Project and Team: Read (vso.project)
    • Code: Read (vso.code)
    • Build: Read (vso.build)
    • Graph: Read (vso.graph)
  7. Click Create and copy the token securely (it won’t be shown again).

For more details, see the Azure DevOps PAT Documentation .

Step 2. Connect Azure Repos to LinearB

After creating a PAT and configuring Service Hooks permissions, connect Azure Repos in LinearB:

  1. In LinearB, go to Settings → Company Settings and select the Git tab.
  2. Click Add Integration.
  3. Select Azure DevOps.
  4. Enter your organization name.
  5. Paste your Personal Access Token (PAT).
  6. Click Connect.

After connecting, LinearB begins processing your Azure Repos data.

Verify the connection

  1. In LinearB, go to Settings → Company Settings → Git.
  2. Confirm that the Azure DevOps integration appears with a connected status.
  3. Open the integration and verify that the expected repositories are listed. For OAuth, check repositories across the organizations accessible to the authorizing account.
  4. Review which repositories are monitored. After processing, check that activity from monitored repositories appears in your LinearB delivery and metrics views.

Reauthorize an existing integration

Reauthorize when you need to change the account that owns the authorization or when authentication stops working. OAuth access tokens are renewed automatically; if Microsoft sign-in expires or access is revoked, reauthorization may be required.

  1. In LinearB, go to Settings → Company Settings → Git.
  2. Open the relevant integration's menu and select Reauthorize.
  3. Review the access notice and click Approve.
  4. To use OAuth, click Reauthorize Azure DevOps, then complete Microsoft sign-in and consent if prompted.
  5. Return to LinearB and verify the connection and expected repository access.

Use an account with the required Azure DevOps organization owner or administrator permissions and Service Hooks permissions. Access after reauthorization depends on the account used, so confirm that it can access all required repositories. Changes may take some time to take effect.

Switch from PAT to OAuth

With OAuth beta access enabled, use Reauthorize on the existing PAT integration and complete the OAuth flow above. This updates the same integration; repository settings and history are retained. Do not create a new integration or disconnect the existing one to switch methods.

Before switching: OAuth-to-PAT reauthorization is not supported. After switching, review any automatic repository monitoring rules and reselect the intended Azure DevOps organizations if needed. OAuth spans the organizations accessible to the authorizing user, whereas the PAT connection covers one organization.

Troubleshooting

The OAuth option is not visible

OAuth is in open beta and must be enabled for your LinearB organization. Contact LinearB Support to request access.

Microsoft sign-in cannot be completed

Use a Microsoft Entra work account with access to the required Azure DevOps organizations. Personal Microsoft accounts are not supported for OAuth. If your organization blocks consent or sign-in, contact your Microsoft administrator.

Some organizations, projects, or repositories are missing

Ensure the authorizing account has access to the required organizations, projects, and repositories. For PAT connections, also verify the organization name and that the PAT was created for the correct organization.

If you changed the authorizing account, verify its repository access. For an organization in another Microsoft Entra tenant, contact LinearB Support if discovery fails; cross-tenant access may require further investigation.

Service Hook creation fails

In the relevant Azure DevOps project, go to Project Settings → Service hooks and open the security settings. Verify that the integration account has View subscriptions and Edit subscriptions permissions, then reauthorize the integration.

These are project-level permissions. Do not add a Service Hooks PAT scope.

An existing connection stops working
  • OAuth: If sign-in has expired, access was revoked, or the authorization account must change, use Reauthorize and complete Microsoft sign-in again.
  • PAT: If the token expired or was revoked, generate a new PAT with all required scopes and reconnect or reauthorize the integration.

If the problem continues after reauthorization, contact LinearB Support.

Connection or reauthorization is blocked by network policies

Ensure the NAT Gateway IP addresses listed in Firewall requirements are allowlisted in your firewall, IP access, and conditional access policies.

Additional troubleshooting and support
  • For PAT connections, ensure the PAT has the required permissions and the organization name is correct.
  • Verify you are an organization owner or have Project Collection Administrator permissions in Azure DevOps.
  • If issues persist, contact LinearB Support or join the Dev Interrupted Discord Server .
Related guides

Need assistance?
Visit our HelpDocs Support Page .

How did we do?

Configuring Release Detection in LinearB

Connecting GitLab to LinearB

Contact