Unable to connect SRE Agent to Azure DevOps Repo

Question

I am having trouble connecting my SRE Agent to my Azure DevOps Repo. The connection is ok but the status has been stuck on pending and connecting for more than a day. It also says that repository cloning has not started yet.

Answer 1

Hello @Lim Xuan Kai ,

Even when using a Personal Access Token (PAT) with full permissions or my own Azure DevOps account, I consistently receive the following error when the agent attempts to create a pull request via chat.

The repository changes are complete, but publishing to Azure DevOps is blocked because the agent cannot access the required Git credentials in the current terminal session. As a result, it requests the minimum required permissions to complete the pull request creation.

fatal: could not read Username for 'https://dev.azure.com': No such device or address

Answer 2

Hello Lim Xuan Kai,

Thank you for reaching out on the Microsoft Q&A portal. Based on your screenshots and description, your Azure SRE Agent has successfully established an initial connection, but the repository clone is stuck in a "Pending" state and indicates "Repository clone has not started yet."

This behavior typically occurs when the identity used for the connection (Managed Identity, OAuth, or PAT) can authenticate to Azure DevOps, but lacks the explicit project-level or code-level permissions required to initiate a clone.

To resolve this issue, please verify the following configurations based on official Microsoft guidelines for the Azure SRE Agent:

1. Confirm Identity Permissions and Access Levels: If you are using a Managed Identity to connect to the Azure DevOps repo:
   • Organization Level: Navigate to Organization settings > Users in Azure DevOps. Ensure the Azure SRE Agent's managed identity is added and assigned the Basic access level. If it is set to Stakeholder, it will not have the rights to view or clone code.
   • Project Level: Ensure the identity is added to the specific Azure DevOps Project and has Code (Read) permissions on the target repositories.

   "If repositories don't appear after a successful connection, this usually indicates the identity has org-level but not project-level access; fix the permissions and then re-open the wizard so the repo list can load."

2. Verify Token Scopes (If using PAT): If you configured the connection using a Personal Access Token (PAT), the token must possess the correct scopes.
   • Edit the PAT in Azure DevOps and ensure it includes the Code (Read) (vso.code) scope.

   "If the scope is too narrow, the connector creation or access will fail and cloning will never start."

3. Refresh the Connector: Once you have adjusted the permissions or generated a new token with the correct scope:
   • Go to Knowledge sources in your Azure SRE Agent
   • Open the Azure DevOps connector configuration.
   • Re-select the Azure DevOps Project and ensure the specific repositories are checked and saved. This will trigger a fresh synchronization.
4. Check Network Connectivity: Ensure that your Azure SRE Agent environment has outbound network access to dev.azure.com. Any firewall or networking rules blocking this outbound traffic will prevent the cloning process from starting.

If the issue persists after fixing the permissions and triggering a resync, it is recommended to delete the connector entirely and recreate it to force a clean initialization.

Let me know if this helps or if you have any follow-up questions in comments. References:

• Tutorial: Connect an ADO repository with managed identity in Azure SRE Agent
• Tutorial: Set up an Azure DevOps connector in Azure SRE Agent

Note: This response is drafted with the help of AI systems.

Answer 3

Use the following checks to unblock the Azure DevOps connector so the repository clone can start.

1. Verify the connector can actually reach Azure DevOps
   • In Azure SRE Agent, go to Knowledge sources and confirm the Azure DevOps connector shows as Connected (not just “Connecting”).
   • If using OAuth, repeat the sign‑in/authorization so a fresh token is issued. If you see a message like Token lacks Code.Read permission, reauthenticate with an account that has the vso.code / Code (Read) scope.
   • If using PAT authentication, edit the connector and confirm:
     • The PAT is valid (not expired).
     • The PAT has at least Code (Read) scope (vso.code). If the scope is too narrow, the connector creation or access will fail and cloning will never start.
2. Confirm the managed identity or account has repo access
   • If the connector uses managed identity:
     • In Azure DevOps, go to Organization settings → Users and ensure the agent’s managed identity is listed with Basic (or higher) access level.
     • Ensure it is added to the relevant project(s) with Code (Read) permissions on the target repositories.
   • If using cross‑account OAuth, verify the signed‑in account has at least Reader access in the target organization and project; otherwise repositories will not load.
3. Re‑select the project and repositories
   • In Knowledge sources, open the Azure DevOps connector configuration.
   • Ensure a valid Azure DevOps Project is selected and that the repositories are listed and saved.
   • If repositories don’t appear after a successful connection, this usually indicates the identity has org‑level but not project‑level access; fix the permissions and then re‑open the wizard so the repo list can load.
4. Check for general integration issues
   • From the SRE Agent troubleshooting guidance:
     • Verify authentication (service principal, OAuth token, or PAT) and permissions again.
     • Confirm outbound network access from the agent to dev.azure.com.
   • If other connectors show as Healthy but Azure DevOps remains Degraded/Connecting after permissions and tokens are fixed, disconnect and recreate the Azure DevOps connector so a fresh sync is triggered.
5. Validate that cloning/indexing is working
   • After fixing permissions and reconnecting, test access from the agent:
     • Ask: What repositories are available in my Azure DevOps organization? or Show me recent commits in <repo>. If the agent can list repos or commits, the connector and cloning are working.
   • For wiki connections, ask a question whose answer is in the wiki and confirm the response includes citations to the Azure DevOps wiki.

If, after these steps, the connector still stays in “Pending/Connecting” for many hours with “Repository clone has not started yet”, capture the current configuration and logs and open an Azure Support ticket, as this can indicate a backend issue rather than configuration.

---

References:

• Tutorial: Connect an ADO repository with managed identity in Azure SRE Agent
• Tutorial: Connect an Azure DevOps wiki to Azure SRE Agent
• Tutorial: Set up an Azure DevOps connector in Azure SRE Agent
• Tutorial: Set up cross-account Azure DevOps access in Azure SRE Agent
• Azure SRE Agent operations troubleshooting FAQ
• Set up GitHub connector (OAuth or PAT) in Azure SRE Agent