Defender for DevOps: Azure DevOps connector onboarding fails since 2026-10-07 (West Europe: 404 from Microsoft.Security, North Europe: 504 GatewayTimeout)

Question

Since 2026-10-07 04:23 UTC our Azure DevOps connector in Microsoft Defender for Cloud has lost its DevOps configuration, and every attempt to repair or re-create it fails in the Microsoft.Security DevOps configuration layer. Nothing was changed on our side before the failure started.

Setup

• One Azure DevOps organization (Entra-connected to the same tenant as the subscription), 9 projects
• Connector created 2026-08-17 in West Europe, Defender CSPM = Standard on the subscription
• Re-authorized on 2026-10-04 with a native tenant user (Project Collection Administrator, Basic access, org policy "Third-party application access via OAuth" = On). Worked: organization and all 9 projects Onboarded, 9 build.complete service hooks created in ADO pointing to dfdrouter-westeurope.dfd.security.azure.com

What happens since 2026-10-07

• Every service hook delivery gets HTTP 404 from dfdrouter-westeurope (nginx HTML page); ADO disabled the hooks "by system"
• GET .../securityConnectors/<name>/devops/default and .../devops/default/azureDevOpsOrgs return 404 with an nginx HTML body on all API versions (2023-09-01-preview, 2024-04-01, 2025-03-01, 2025-11-01-preview). The connector resource itself is readable.
• Portal "Reauthorize": securityConnectors/devops/write fails with NotFound (nginx 404 body)
• Portal delete fails (batch item 404); ARM DELETE via CLI works (204). All stale hooks were removed by the service.
• Re-creating the connector in West Europe: ARM resource is created (offering CspmMonitorAzureDevOps), but the DevOps configuration write fails again with the nginx 404.
• Creating a new connector in North Europe: ARM resource created, securityConnectors/devops/write fails with 504 GatewayTimeout ("The gateway did not receive a response from 'Microsoft.Security'"). Afterwards GET devops/default returns {"code":"NotFound","message":"DevOps configuration was not found"} and azureDevOpsOrgs returns {"code":"ConnectorNotAvailable"}.
• The Azure portal troubleshooter (Support + troubleshooting) reports the same: top-level connector resources are created successfully, the devops/default subresource fails (WEU 404, NEU 504), no Service Health incidents.

Already verified

• Both OAuth authorizations (current user and the previous one) were present when the failure started; the failure is not caused by a revoked grant
• Defender CSPM pricing Standard, no Activity Log changes between 2026-10-06 and 2026-10-13 except our own tests, no Service Health events
• Azure DevOps itself is healthy, pipelines run, OAuth policy On, user has PCA + Basic

Questions

1. Is there a known issue with the Defender for DevOps configuration backend (West Europe / North Europe) since 2026-10-07?
2. Can a backend record of the deleted connector still block onboarding of this organization (one organization per tenant)? If so, how can it be cleared?
3. What is the supported path to get the organization onboarded again? We can provide tenant ID, subscription ID, connector hierarchy identifiers and correlation IDs privately.

Answer 1

We have the exact same issue. Since Oct 7 the config returns a 404 on each webhook notification from builds.