Prerequisites
- Role: You need Organization Owner or Project Collection Administrator access in the Azure DevOps organization you want to connect.
- Microsoft account: The account you sign in with must have that access in the organization. Being signed in to Microsoft is not enough on its own.
- Microsoft Entra connection: The Azure DevOps organization should be connected to a Microsoft Entra tenant. Check this in Azure DevOps under Organization settings → Microsoft Entra.
- Tenant (only if needed): If you sign in with a personal Microsoft account, or with an account from a different tenant than your Azure DevOps organization, keep the tenant ID (GUID) or verified domain (for example
contoso.onmicrosoft.com) ready. You can find both in the Azure portal under Microsoft Entra ID → Overview.
Which Account to Use
LowerPlane sees only what the connecting account can see.- Use an account that is an owner or administrator of the organization. Otherwise LowerPlane may not see all repositories, projects, or members.
- Prefer a dedicated integration account over a personal admin account, so the connection keeps working when people leave.
- Make sure Conditional Access policies (for example device-compliance rules) don’t block this account. LowerPlane renews access in the background, and a blocked account stops syncing.
- Connect from a private browser window, and sign out of other Microsoft accounts first.
- Check the account name on the Microsoft sign-in and consent screens before accepting.
Permissions and Data
LowerPlane requests these permissions when you connect:
LowerPlane reads:
Repositories
Name, project, visibility, default branch, size, fork and disabled status
Branch Policies
Required reviewers, build validation, and other required policies on the default branch
Pull Requests
Status, requested reviewers, approvers, and build status checks
Organization Members
Name, email, access level (license), status, and last access, for access reviews and offboarding checks
Setting Up the Integration
1
Open Integrations
Log in to LowerPlane and go to Integrations.
2
Find Azure DevOps
Search for Azure DevOps (Version Control category) and click Connect. The connection type is OAuth.
3
Enter your tenant (only if needed)
Enter your Microsoft Entra Tenant (tenant ID or verified domain) only if you sign in with a personal Microsoft account or with an account from a different tenant than your Azure DevOps organization. Otherwise leave it empty.
4
Connect
Click Connect with Azure DevOps. You’ll be redirected to the Microsoft sign-in page.
5
Sign in and accept
Sign in with the account that has owner or administrator access, review the requested permissions, and click Accept.
6
First sync
You’re returned to LowerPlane, the integration shows as connected, and the first sync starts automatically.
After Setup
- The first sync usually finishes within a few minutes. Large organizations take longer.
- LowerPlane keeps syncing automatically on the integration’s sync schedule. You can also click Sync on the integration at any time.
- To verify, open Repositories and check your Azure DevOps repositories and pull requests are listed, then open Tests and filter by Azure DevOps to see results.
If your account belongs to more than one Azure DevOps organization, LowerPlane connects the first organization it finds. Connect with an account that belongs only to the organization you want to monitor.
Migrating from the Legacy Azure DevOps Connection
Earlier versions of LowerPlane connected through the legacy Azure DevOps OAuth service. These connections must be reconnected through Microsoft Entra ID.1
Open the existing connection
Go to Integrations and open your connected Azure DevOps integration.
2
Reconnect
Click Reconnect. Don’t use Connect again, because that creates a second connection to the same organization.
3
Enter your tenant (only if needed)
Enter the tenant only if you use a personal Microsoft account or an account from a different tenant.
4
Sign in and accept
Sign in with an owner or administrator account and accept the permissions.
5
Verify
After the sync finishes, check Repositories and Tests to confirm your data is back.
Security Tests
LowerPlane runs 6 tests against your Azure DevOps organization:How Repository Tests Are Evaluated
To add branch policies, open Project settings → Repositories → select the repository → Policies → select the default branch.
Azure DevOps does not report per-user MFA. MFA for Azure DevOps is enforced by Microsoft Entra ID (Conditional Access), so it is covered by the Microsoft Entra ID / Azure AD integration rather than this one.