Configure authentication to Azure DevOps

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Azure DevOps from the Previews page. See Manage Azure Databricks previews.

This page shows how to configure Azure DevOps to enable authentication from Azure Databricks for the Azure DevOps connector. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Azure Databricks.

Prerequisites

• An Azure DevOps organization connected to a Microsoft Entra tenant. See Use service principals and managed identities.
• Permission to register an application in Microsoft Entra ID.
• Permission to add users to the Azure DevOps organization. A member of Project Collection Administrators can add the service principal.

Configure Azure DevOps

The connector authenticates as a Microsoft Entra service principal. Register an application in Microsoft Entra ID, then add its service principal to your Azure DevOps organization. See Use service principals and managed identities.

Register a Microsoft Entra application

1. In the Microsoft Entra admin center, select App registrations > New registration.
2. Enter a descriptive name and select the supported account type for your application.
3. Leave Redirect URI empty.
4. Click Register.
5. On the application Overview page, note the Application (client) ID and Directory (tenant) ID.

Create a client secret

1. In App registrations, select your application.
2. Select Certificates & secrets > Client secrets > New client secret.
3. Add a description, select an expiration, and click Add.
4. Note the client secret Value. Microsoft Entra ID doesn't display it again after you leave the page.

See Add and manage app credentials in Microsoft Entra ID.

Add the service principal to Azure DevOps

1. In Azure DevOps, select Organization settings > Users.
2. Select Add users.
3. Enter the display name of the service principal.
4. Select the Basic access level and the projects to ingest. Azure Repos access requires Basic or a higher access level. Stakeholder access doesn't include Azure Repos.
5. Select Add.

Azure DevOps doesn't use Microsoft Entra application permissions to authorize the service principal. Grant access through the access level, project membership, and Azure DevOps group memberships. The connector ingests only the projects and resources that the service principal can access.

Next steps

Create an Azure DevOps connection in Azure Databricks. See Create an Azure DevOps connection.