Azure DevOps

The Corma and Azure DevOps integration keeps your organization's access levels and groups in line with the developers who use them. Microsoft describes Azure DevOps as a cloud-based platform of integrated tools for software development teams, from planning and code to builds, tests and deployment. Access levels drive the bill, and Microsoft Entra ID often decides who keeps access.

Key takeaways

• Azure DevOps Basic access is free for the first 5 users and paid from the 6th, while Stakeholder access is free for an unlimited number of users.
• Removing a user from an Azure DevOps organization does not remove their Microsoft Entra group memberships, so access granted through a group remains.
• Azure DevOps administrators can restrict global and full-scoped personal access tokens and set a maximum PAT lifetime, a policy that is off by default.
• Azure DevOps auditing is available only for organizations backed by Microsoft Entra ID, is off by default and keeps events for 90 days.

Why can Azure DevOps access outlive offboarding?

Microsoft's page on removing users warns that removing someone from the organization does not remove their Entra group memberships, so a member of an access-granting group keeps access. Users disabled or removed in the Entra directory can no longer reach the organization by any mechanism, including personal access tokens (PATs) and SSH. Microsoft's pages differ on whether those PATs are revoked or only blocked, so revoking them is the safer step.

Entra service principals and managed identities can run automation without being tied to an employee account, and each one uses a license in every organization where it gets a paid access level. Removing one from Entra ID does not remove its Azure DevOps membership. Token access events are not logged: the audit log shows PAT lifecycle changes, not when a PAT was used. Microsoft's DevOps blog has postponed the decommissioning of existing global PATs to January 27, 2027.

How Corma governs Azure DevOps

• Paid access levels in view: Basic and Basic + Test Plans access levels sit in SaaS subscription management, and billing stops when an unused user is removed or moved to the free Stakeholder level.
• Leavers checked beyond the organization: a leaver workflow in the IT Workflow Builder asks an admin to remove the person from access-granting Entra groups as well as from the organization, and to revoke their PATs.
• Admin groups under review: Project Collection Administrators and Project Administrators go into automated access reviews.
• Application identities with an owner: service principals and managed identities are non-human identities, so each one needs a named owner, while PATs stay tied to the person who created them.

Frequently asked questions

Does Azure DevOps support SSO and SCIM?

Single sign-on comes from connecting the organization to Microsoft Entra ID, so users sign in with work credentials and admins can apply Conditional Access policies. Microsoft documents no separate SAML or SCIM setup for Azure DevOps: provisioning runs through Entra group rules and the User Entitlements REST API. See also how Corma covers Microsoft Entra ID.

How does Corma connect to Azure DevOps?

Through the User Entitlements REST API where it fits, which can list users with their entitlements and delete a user from the organization, or through Corma's browser-based agents in the organization settings. See also how Corma covers code platforms such as GitHub.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want leavers to lose Azure DevOps access through every Entra group? Book a Corma demo.