Azure DevOps Integration

Overview

The Azure DevOps integration connects your Azure DevOps organization to Fencer via OAuth. Once connected, you can add repositories for code scanning, receive automatic scans on push and pull request events, and see scan results reported as commit statuses directly on your Azure DevOps commits and pull requests. Fencer can also open fix pull requests and sync your organization members as identities.

Prerequisites

• An active Fencer organization with a valid subscription.
• The Administrator role in your Fencer organization.
• Access to an Azure DevOps organization with permission to authorize third-party applications.

How it works

Fencer uses Microsoft’s OAuth 2.0 authorization code flow. When you initiate a connection from Fencer, you provide your Azure DevOps organization URL and are redirected to Microsoft to authorize the application. After authorization, Fencer stores encrypted OAuth tokens and creates a connection linked to your Azure DevOps organization.

Repositories are added individually — you search for and select repositories from your organization, and Fencer registers service hook subscriptions on each one. The hooks listen for push events (git.push), pull request created events (git.pullrequest.created), pull request updated events (git.pullrequest.updated), and pull request comments (used to start AI PR reviews). Push and pull request events trigger code scans automatically, and scan results are reported back to Azure DevOps as commit statuses, so you can see pass/fail results directly on commits and pull requests.

Usage / Configuration

Connecting Azure DevOps to Fencer

1. Go to Admin > Integrations.
2. Under Available Integrations, click the Azure DevOps (Code) card.
3. Click Continue to proceed to the connection form.
4. Enter your Organization url (e.g., https://dev.azure.com/my-org).
5. Click Connect Azure DevOps. A popup opens and redirects you to Microsoft to sign in and authorize the application.
6. After authorization, the popup closes and you are taken to the connection’s edit page.

Note

You can find your organization URL at dev.azure.com/your-organization. The URL must include the full path to your Azure DevOps organization.

Adding Repositories

After connecting, you need to add repositories individually:

1. Go to Admin > Integrations and click Edit on your Azure DevOps connection.
2. Click Add repositories and search for repositories in your organization.
3. Click Add next to a repository. Fencer fetches the repository details (default branch, visibility), registers service hook subscriptions, and triggers an initial code scan.

Removing Repositories

1. Go to Admin > Integrations and click Edit on your Azure DevOps connection.
2. Under Connected repositories, click Remove repository on the repository and confirm with Remove.
3. Fencer removes the service hook subscriptions and soft-deletes the repository. Existing scan results are preserved.

Code Scanning on Push and Pull Requests

Code scans are triggered automatically when Azure DevOps delivers webhook events:

• git.push — triggers a scan for the pushed branch and commit.
• git.pullrequest.created and git.pullrequest.updated — triggers a scan for the pull request source branch.

Commit Status Reporting

Fencer reports scan progress back to Azure DevOps as commit statuses. The status progresses through:

1. pending — the scan is queued or in progress.
2. succeeded or failed — the scan completed. failed means the scan tripped one of the repository’s Checks settings (for example Fail on new vulnerabilities if), configured on the repository’s settings page under Posture > Code; otherwise the status is succeeded.

If a scan crashes, is cancelled, or times out, Fencer sets the status to error. A push to a branch outside the repository’s branch scope gets a succeeded status explaining that automatic scans were not run.

These statuses appear on the commit in Azure DevOps, including in the pull request view, with a link back to the scan details in Fencer.

Fix Pull Requests

When you open a pull request from an AI fix for a vulnerability, Fencer commits the fix to a new branch on your Azure DevOps repository and opens a pull request against the branch the vulnerability was found on.

Identity Sync

The Azure DevOps integration syncs your organization members as identities in Fencer using the Azure DevOps Graph API. This includes member usernames, display names, and email addresses.

Suspending and Resuming Scans

1. From the Azure DevOps connection edit page, find the repository under Connected repositories.
2. Click Suspend. Fencer stops triggering scans for this repository.
3. Click Resume to start scanning it again.

Toggling Scope

Each connected repository can be marked as in scope or out of scope:

1. From the Azure DevOps connection edit page, find the repository.
2. Click the scope toggle. Out-of-scope repositories are excluded from scope-based reporting and views without being deleted (see Asset Scope Management).

Re-authorizing a Connection

If your OAuth tokens expire or become invalid, the connection edit page shows a warning: “Your Azure DevOps access token is invalid or has expired.” To re-authorize:

1. Go to Admin > Integrations and click Edit on your Azure DevOps connection.
2. Click the Reconnect Azure DevOps link to go through the OAuth flow again in a popup.
3. Fencer updates the stored tokens without recreating the connection or losing your configured repositories.

Disconnecting

1. Go to Admin > Integrations and find your Azure DevOps connection.
2. Click Remove on the connection and confirm with Remove.
3. Fencer removes the service hook subscriptions, clears stored OAuth tokens, and soft-deletes all associated repositories.

Examples

Typical workflow with a pull request

1. A developer opens a pull request on a connected Azure DevOps repository.
2. Azure DevOps sends a git.pullrequest.created webhook event to Fencer.
3. Fencer triggers a code scan for the PR source branch and sets a pending commit status.
4. The scan runs, analyzing the source branch for vulnerabilities and secrets.
5. On completion, the commit status updates to succeeded or failed with a link to the scan details in Fencer.
6. The developer reviews the scan status directly in the Azure DevOps pull request interface.

Connecting multiple Azure DevOps organizations

If your company uses multiple Azure DevOps organizations, create a separate connection for each one:

1. Connect the first organization as described above.
2. On Admin > Integrations, click Add new connection on the Azure DevOps card under Active Integrations.
3. Enter the next organization URL and authorize. Repeat for each additional organization.
4. Each connection manages its own repositories and OAuth tokens independently.

Troubleshooting

• OAuth authorization fails: Ensure you are signing in with an account that has access to the Azure DevOps organization. The account must be able to authorize third-party applications for the organization.
• Scans not triggered on push or pull requests: Check that the repository is not suspended and that the connection’s tokens are still valid. Removing and re-adding the repository registers its service hooks again.
• Commit statuses not appearing on pull requests: Check the connection on the edit page. If the token has expired, use the re-authorize flow to refresh your credentials.
• Repository search returns no results: Verify the authorized account has access to the repositories in the Azure DevOps organization. Fencer searches across all projects in the connected organization.
• Access token expired warning: OAuth tokens have a limited lifetime. The edit page displays a warning when tokens are invalid. Click Reconnect Azure DevOps to re-authorize.

Related pages

• Integrations Overview
• Code Scanning
• Generic Git Integration
• Identity Management