Share via

Issue with Listing Azure DevOps Organizations for a Service Principal

Jai Garg 60 Reputation points
2025-03-20T07:35:47.69+00:00

Hi,

Using the client credentials flow as a service principal to authenticate with Azure DevOps. The service principal is added to the Azure DevOps organization and is also a member of the PCA group.

Using the application ID, client secret, and tenant ID, we successfully generate an access token. However, when attempting to list the organizations that this service principal has access to, we encounter an issue.

We are following this approach:

  1. Retrieve the member ID of the service principal using: GET https://app.vssps.visualstudio.com/_apis/profile/profiles/me?api-version=5.1
  2. Use the extracted member ID to get the list of accessible organizations: GET https://app.vssps.visualstudio.com/_apis/accounts?memberId={memberId}&api-version=5.1

The issue arises in step 2: the API does not return the expected list of organizations for the service principal.

Is there an alternative API or recommended approach to retrieve the list of all Azure DevOps organizations that a service principal has access to?

Thanks in advance!

Azure DevOps

Answer accepted by question author

Arko 4,180 Reputation points Moderator
2025-04-02T10:22:33.9633333+00:00

Hello Jai Garg, as discussed, the API https://app.vssps.visualstudio.com/_apis/accounts?memberId=<id> is intended to be used in a user context, specifically with a user Object ID (OID) from Azure AD (Entra). When using the client credentials flow with a service principal, this endpoint doesn't return the expected results because service principals aren't treated the same way as users in this context.

If your goal is to list Azure DevOps organizations for an identity, the supported way is to use the OAuth2 Authorization Code flow with a real user account. Alternatively, for testing purposes, you can use a Personal Access Token (PAT) tied to a user, which works reliably with this API.

As of now, there's no public API that supports listing organizations for a service principal via the client credentials flow. The service principal can still be used to access specific Azure DevOps organizations it’s been added to, but discovering all accessible orgs programmatically isn't supported in this flow.

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.