Azure Question posted in
The official documentation to get you started can be found here.

How Microsoft Entra ID OAuth works for Azure DevOps?

I have created a new Azure App, but I didn’t add any permissions related to Azure DevOps.

enter image description here

Then, I added this app to the Project Collection Administrators group in the Azure DevOps organization. I tried creating a project with the REST API, and it was successful.

I’m confused as to why it was able to successfully make a REST API call without adding any Azure DevOps permissions.

Tags:

2

Answers


  1. 0

    Firstly, an app in Entra ID can acquire an access token using the client credentials flow for any API in that same tenant without being assigned permissions to it.
    This enables scenarios such as this where the API itself does the authorization.

    And secondly, when you assigned the app in Azure DevOps, its id/objectId was stored there. The access token also contains this ID so Azure DevOps knows it is this app that has been assigned the role and is thus allowed to do the operation.

    Login or Signup to reply.
  2. 0

    Initially, I registered one application in Microsoft Entra ID without adding any DevOps related permission like this:

    enter image description here

    Now, I added this application to Project Collection Administrators group in the Azure DevOps organization as below:

    enter image description here

    If the access token is generated using client credentials flow, access will be based on application context and it will inherit permissions associated with Project Collection Administrators group of DevOps organization.

    POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token

client_id: appId
client_secret: secret
grant_type: client_credentials
scope: 499b84ac-1321-427f-aa17-267ca6975798/.default

    enter image description here

    Using above token, you can make calls to Azure DevOps API like this:

    enter image description here

    But if you are generating access token using delegated flows like authorization code flow that involves user interaction, adding Azure DevOps permissions of Delegated type in app registration is mandatory.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search