How to authenticate Azure Registered App for DevOps Access From Azure Data Factory

Berean_20 1

My goal is to retrieve work items from DevOps from Azure Data Factory.

I can successfully retrieve the work items from Postman using details from the Azure Registered App. However, when attempting to obtain the access token from Postman it will prompt me to enter my Azure Credentials. Obviously, there is no such prompt when running the pipeline from ADF.

My question: how can I obtain the token from Azure Data Factory knowing there is no prompt for Azure credentials while the pipeline is running?

This is the error I get from running the pipeline in ADF:

{"$id":"1","innerException":null,"message":"TF400813: The user '' is not authorized to access this resource.","typeName":"Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server","typeKey":"UnauthorizedRequestException","errorCode":0,"eventId":3000}

How do I provide the authentication details in Azure Data Factory (ADF) which are prompted by Postman?
What authentication method should I use from Azure Data Factory to replace the prompt for credentials as it happens in Postman?

HimanshuSinha-msft 19,386 Reputation points Microsoft Employee

2022-07-15T22:03:10.843+00:00
Hello @Berean_20 ,
Thanks for the question and using MS Q&A platform.

As we understand the ask here is how to authenticate the devops web calls , please do let us know if its not accurate.
I am not sure if you are aware that there is something called Personal acces token , which you can use .
https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows

Please do let me if you have any queries.
Thanks
Himanshu

Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how

Want a reminder to come back and check responses? Here is how to subscribe to a notification

If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators
HimanshuSinha-msft 19,386 Reputation points Microsoft Employee

2022-07-19T19:55:14.68+00:00

Hello @Berean_20 ,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .In case if you have any resolution please do share that same with the community as it can be helpful to others . Otherwise, will respond back with the more details and we will try to help .
Thanks
Himanshu
Berean_20 1 Reputation point

2022-07-19T22:50:12.083+00:00

In DevOps I created a PAT as you suggested but still have a Unauthorized error message:

{"$id":"1","innerException":null,"message":"TF400813: The user '' is not authorized to access this resource.","typeName":"Microsoft.TeamFoundation.Framework.Server.UnauthorizedRequestException, Microsoft.TeamFoundation.Framework.Server","typeKey":"UnauthorizedRequestException","errorCode":0,"eventId":3000}

What user is it referring to?

Here's the HTTP request:
https://analytics.dev.azure.com/xxxx/<project name>/_odata/v2.0/WorkItems?$select=WorkItemId,WorkItemType,Title,ChangedDate&$filter=ChangedDate%20ge%202022-06-28Z

I place the PAT in a variable in ADF.
Berean_20 1 Reputation point

2022-07-20T00:38:16.75+00:00
I'm getting a little bit muddled up about all these different client apps and how to use them in Azure Data Factory pipeline:

First of all you have App Registration in Azure Active Directory which includes Client ID, Client Secret and Redirect URL.

Then you have Applications in DevOps that are created and need to be authorized. These apps, again, have App IDs, Client Secrets, Scope and so forth, just like the Azure App Registrations.

The App Registration in Azure Active Directory has consent and has permission to DevOps under user_impersonation.

When I use these the Azure App Registration in Postman to query the REST API using OAuth2 I'm always prompted to sign in to the resource API (DevOps) to acquire a token. I successfully get the expected results.

I'm unable to authorize the application created in DevOps and I'm not sure which relationship it has the App Registration created in Azure DevOps Active Directory.

I have a logic app in DevOps which is authorized but the same cannot happen with the other app/service.

Perhaps the redirect URL is not correct.

If I use the access token acquired in Postman in Data Factory then I can query the DevOps API successfully.

In ADF I still can get a token if I use the following URL to get the token https://login.microsoftonline.com/40exxxxxxxxxxxxxxxx7a/oauth2/v2.0/token. However it doesn't work (authorized error) because I simply can't get the sign in as it happens in Postman.

I would be really grateful for some clarification on this issue.
HimanshuSinha-msft 19,386 Reputation points Microsoft Employee

2022-08-03T22:36:16.413+00:00

Hello @Berean_20 ,
Thanks for the patience , unfortunately we are not getting the kind of response from the team here . if you have a support plan you may file a support ticket, else could you please send an email to azcommunity@microsoft.com with the below details, so that we can create a one-time-free support ticket for you to work closely on this matter.
Subscription ID:
Subject : Attn Himanshu
Please let me know once you have done the same.
Thanks
Himanshu
HimanshuSinha-msft 19,386 Reputation points Microsoft Employee

2022-08-15T16:22:00.993+00:00

Hello @Berean_20 ,
We haven’t received any email from you as requested in the last response and was just checking back to see if you have a resolution . In case if you have any resolution please do share that same with the community as it can be helpful to others . Otherwise, please respond back with the more details as requested and we will try to help .
Thanks
Himanshu

Share via

How to authenticate Azure Registered App for DevOps Access From Azure Data Factory