Integrate Azure DevOps issue tracking

Prerequisites

The APIsec platform requires the Personal Access Token, Organization Name, Project, and optionally the Area Path to connect with Azure DevOps using the Personal Access Token method.

Personal Access Token

Follow the steps below to obtain a Personal Access Token
- Log in to your Azure DevOps account
- Click on User Setting and select Personal Access Token
- Click on New Token
- Enter token name and select scope
- Click on Create and copy the token
- Organization Name: Copy Organization name from the dashboard
- Project: Copy Project from the dashboard
- Area Path (optional): Teams use it to determine what shows up on the team's backlog and what work items the team is responsible for.
  - Follow the steps below to obtain the Area Path
    - Click on Project Settings
    - Click on Project configuration
    - Select Areas
    - Click on New Child,
    - Enter the Area name, click Save and close, and copy the name

Service Principal

Follow the steps below to obtain a Service Principal

1. Create a Service Principal
- Go to the Azure Portal → Microsoft Entra ID → App registrations → New registration.
- Enter a name (e.g., ADOServicePrincipal).
- Select "Accounts in this organizational directory only".
- Set the Redirect URI (optional for service principals).
- Click Register.
2. Retrieve Tenant ID and Client ID
- After registering the application:
- Go to the Overview page of your registered app.
- Copy the following values:
  - Application (client) ID → This is your CLIENT_ID.
  - Directory (tenant) ID → This is your TENANT_ID.
- Save both securely — you will need them to configure the connection in APIsec.
3. Generate a Client Secret
- Open your newly created app.
- Navigate to Certificates & secrets → New client secret.
- Add a description and set an expiration (e.g., 6 or 12 months).
- Copy and securely store the generated value — this is your CLIENT_SECRET.
4. Add Microsoft Graph Permission
- Navigate to API Permissions → Add a permission → Microsoft Graph → Delegated permissions.
- Select User.Read.
- Click Add Permissions
- Click Grant admin consent for Default Directory.
5. Create a Project and Define Area Path
- In ADO, create a new Project (if not already available) under Organization Settings → Projects → New Project.
- Under the project, go to Boards → Project Configuration → Areas and Iterations.
- Define an Area Path (used to categorize and track bugs created by APIsec).

Create an Azure DevOps connection

Open your browser and visit: https://<your-tenant>.apisecapps.com
Click on Integrations
Click on the Issue Tracker tab
You can find the Azure DevOps Issue Tracker.
- Click Manage
- There are two scenarios here. If Azure DevOps Connections already exist, they are listed along with a New Connection button.
  - In this case, click New Connection. Otherwise, the form to create an Azure DevOps Connection is displayed directly.
  - The Azure DevOps connection form is displayed.
  APIsec supports two authentication methods for connecting your Azure DevOps account:
  1. Personal Access Token (PAT)
  2. Service Principal.
  PAT is the default method shown when you create a new Azure DevOps issue tracker. Fill in the form with all the required fields.
  - Name - Specify a unique name for the connection.
  - Authentication Method - Personal Access Token (PAT)
  - Personal Access Token - Personal Access Token (PAT) generated from your account
  - Organization Name - Enter the name of your organization as registered in your service
  - Work Item Type - Choose whether vulnerabilities create an Issue or a User Story in Azure DevOps.
  - Project - Enter target project within your organization
  - Severity Selection – A multi-select dropdown with options Critical, High, Medium, and Low. This gives you control over which severity levels are synced to your issue tracker.
  - Area Path - Enter Area Path without the project name.
  - Labels – Enter single-word labels without spaces. For multiple labels, separate them with commas (,).
  - Make Connection Private - Toggle this switch to make the connection private
If you are using Service Principal to create a new Azure DevOps issue tracker then select Service Principal as the authentication method and fill in the form with all the required fields.
- Name - Specify a unique name for the connection.
- Authentication Method - Service Principal
- Client ID - Enter the Client ID
- Secret - Enter the Client Secret associated with your Azure AD application.
- Tenant ID - Provide the Tenant ID
- Organization Name - Enter the name of your organization as registered in your service
- Work Item Type - Choose whether vulnerabilities create an Issue or a User Story in Azure DevOps.
- Project - Enter target project within your organization
- Severity Selection – A multi-select dropdown with options Critical, High, Medium, and Low. This gives you control over which severity levels are synced to your issue tracker.
- Area Path - Enter Area Path without the project name.
- Labels – Enter single-word labels without spaces. For multiple labels, separate them with commas (,).
- Make Connection Private - Toggle this switch to make the connection private
- Click Test Connection
- Test connection successful
- Now click Create Connection
- You can now view the created connection in the list below

Edit an Azure DevOps connection

Open your browser and visit: https://<your-tenant>.apisecapps.com
Click on Integrations
Click on the Issue Tracker tab
You can find the Azure DevOps Issue Tracker.
- Click Manage
Click the Pencil icon for the Azure DevOps connection you want to edit.
Edit the connection details. You can also update severity filters for the existing connection (if they are not updated). Changes apply to future scans and automatically close tickets that don't match the selected severities to maintain consistency. However, the corresponding vulnerabilities will still exist in the platform.
Click Test Connection
Test connection successful
Click Update Connection
The connections list is displayed

Delete an Azure DevOps integration

Open your browser and visit: https://<your-tenant>.apisecapps.com
Click on Integrations
Click on the Issue Tracker tab
You can find the Azure DevOps Issue Tracker.
- Click Manage
Click Delete icon for the Azure DevOps connection you want to delete
Click Delete to confirm

Set up an Azure DevOps connection with the application

You can integrate Azure DevOps with the application to automatically track and manage issues. This integration creates tickets in Azure DevOps for easier tracking and resolution.

Navigate to: https://<your-tenant>.apisecapps.com
Click on Application
From the left navigation select Issue Tracker
The list of Issue Trackers available in the tenant is displayed.
To create a new Azure DevOps connection from here, click New Issue Tracker, select AzureDevOps, and create a new connection.
From that list, select the Azure DevOps connection and click Test Connection.
Test connection successful.
Now click on the Activate Connection
Connection activated.

The configured connection appears in the list as First connection.

note
A user role with View permissions cannot configure the Azure DevOps issue tracker in a shared application.
To remove the connection from the application, click the Delete icon beside the configured connection
Click Confirm to remove the connection

note
A user role with View permissions cannot remove the Azure DevOps issue tracker from a shared application.