Automatically Provision Azure DevOps Licenses Based on Entra ID Group Membership

Question

I am working with Microsoft Entra ID and Azure DevOps, and I am exploring the possibility of automatically provisioning Azure DevOps licenses to users based on their Entra ID group membership. The Azure DevOps organization is connect with Microsoft Entra.

I created an Entra ID group that represents a team or department within our organization. Users are added to this group as they join the team. When a user is added to the group, they should automatically receive an Azure DevOps license, e.g. Stakeholder or Basic. Conversely, if a user leaves the group or organization, their Azure DevOps license should be revoked. Is this kind of automatic license provisioning possible? What steps do I need to take to set this up? Are there any best practices or considerations I should be aware of?

Thank you for any guidance or insights.

Answer 1

I found a solution to automatically provision Azure DevOps licenses based on Entra ID group membership.

Posting the solution here in case somebody needs it:

1. Create the Entra ID Group and add the members to id.
2. In the Azure DevOps portal, set up group rules and add the Entra ID group: https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/assign-access-levels-by-group-membership?view=azure-devops

Answer 2

Hi @Radu Ifrim ,

Thanks for reaching out.

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer.