> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-azurerepos.md).
# Azure Repos
Integrate Prisma Cloud with your Azure Repos version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the Azure Repos platform. This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, exposed secrets, license mis-compliance and CI/CD pipeline risks in your Azure Repos, allowing you to understand and fix issues as soon as they are detected, resulting in an enhanced security posture for your organization.
## Multi-Token Integration
Prisma Cloud supports multiple Azure Repos accounts for a single Prisma Cloud tenant using multiple OAuth user tokens, without having to change any permission settings in Azure Repos. You can connect multiple organizations from the same Azure Repos account (using a single VCS user token), or use multiple tokens to connect multiple organizations, regardless whether they belong to the same Azure Repos account. This capability increases your organization’s readiness and scale.
The Azure Repos integration creates a webhook that triggers periodic scans of your code. These scans run on all pull requests (PRs), and their results are displayed in both the PR comments and reports.
Refer to [Subscribed Events](#subscribed-events) below for a list of events to which the integration is subscribed.
1. Before you begin.
1. Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your Azure Repos VCS, as specified in [User Permissions](#user-permissions) below.
2. Add the Prisma Cloud IP addresses and hostname for Application Security to an [allow list](/content-collections/get-started/console-prerequisites.md) to enable access to the Prisma Cloud Console.
3. On the Azure DevOps console.
* Enable third-party application access to Azure DevOps via OAuth to configure integration for both single organization and multiple organizations using a single user token. Do not limit authorization scope
* To ensure that Prisma Cloud has access to repositories, select **Project Settings > Settings > General** > and set **Limit job authorization scope to current project for non-release pipelines** to **OFF**.
See [third-party application access via OAuth](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/change-application-access-policies?view=azure-devops) for more information on Prisma Cloud access to all organizations associated with your user token.
2. On the Prisma Cloud Application Security console.
1. Select **Settings** > **Connect Provider** > **Code & Build Providers**.
2. Select **Azure Repos** (under Code Repositories) in the catalog that is displayed.
3. Select **Single Organization** or **Multiple Organizations** in the **Configure Account** step of the installation wizard that is displayed.
**Multiple Organizations** sets up an Azure Repos account that covers multiple organizations.
4. Select **Authorize**.
You are redirected to Azure Repos to authorize Prisma Cloud access. Follow the wizard’s instructions based on whether you chose one or multiple organizations. All Azure Repos organizations you authorize will be scanned in the future.
3. Authorize Prisma Cloud on Azure Devops.
1. Review the requested permissions and then select **Accept** to authorize the Prisma Cloud console to access your organization account and repositories.
You are redirected to the **Enable CI/CD Security (Optional)** step of the Azure Repos installation wizard on the Prisma Cloud console. This step, which is optional, provides protection for the CI/CD systems in your Azure Repos environment.
4. Enable CI/CD Security.
1. To begin, you must first enable the [CI/CD Security Module](/content-collections/application-security/get-started/application-security-license-types.md).
2. Fill in the provided fields.
* Azure **User Name**: To find your Azure DevOps user name, access your Azure organization and then select **User settings > Profile**.
* Azure **App Password**. In Azure, generate a [Personal Access Token](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops\&tabs=Windows) (PAT) > make a copy for safekeeping > paste the PAT in the *App Password* field.
Use the following values when creating the PAT:
* Set an **Expiration** date through **Organization > all accessible organizations**.
* Scope the authorization access for the token.
* Agent Pools (Read)
* Analytics (Read)
* Auditing (Read Audit Log)
* Member Entitlement Management (Read)
* Pull Request Threads (Read & write)
* Service Connections (Read)
* Tokens (Read & manage)
* Variable Groups (Read)
3. Select **Next**.
The **Select Repositories** step of the wizard is displayed.
5. Select which repositories will be scanned:
* **Permit all existing repositories**
* **Permit all existing and future repositories**. This is the recommended option to ensure complete coverage and successful operation of all features.
* **Choose from repository list** > Select repositories
The selected repositories associated with the PAT will be scanned.
A single repository may be shared across one or more user tokens. In this case, any change made to a shared repository scan applies to all associated user tokens.
6. Select **Next** > **Done** in the **Status** step of the wizard to complete the integration.
7. Verify integration:
1. In **Application Security**, select **Home** > **Settings** > **Code & Build Providers**.
2. Confirm that the status of the integrated **Azure** repositories displays **Connected** under **Status**.
It may take up to 3 minutes for the integration status to be updated.
8. Next step: Monitor and manage scan results.
* View your selected Azure repositories on the **Repositories** page. The next Azure scan will include these repositories
* To view scan results and resolve issues, in **Application Security** select **Home** > **Projects**. See [Monitor and Manage Code Build Issues](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/monitor-and-manage-code-build.md) for more information
## Manage integrations
On **Code & Build Providers**, you can also manage the integration by reselection of repositories and deletion of the repository and the integration.
* **Reselect repositories**: Enables you to access the list of repositories for a scan.
* **Delete repository**: Enables you to delete repositories for a scan from the account.
* **Manage VCS user tokens**: Enables you to integrate one or more Azure Repos accounts.
You cannot delete the integration from **Repositories** for an account integration that supports multiple user tokens.
## User Permissions
Authorize the user integrating Prisma Cloud with your Azure Repos instance with the following permissions.
* **Project Administrator**: This permission is required to subscribe to webhooks. For more information refer to the Microsoft [Integrate with service hooks](https://learn.microsoft.com/en-us/azure/devops/service-hooks/overview?view=azure-devops#q-what-permissions-do-i-need-to-set-up-a-subscription) documentation
* **Administrator repository** permissions: In order to scan pull requests (PRs), the user performing the integration must have administrative privileges for the repositories. This enables Prisma Cloud to set up subscription webhooks for the selected repositories
* **Identity (read) \[vso.identity]**: This permission grants read access to identity-related information or configurations within Azure DevOps. It allows the user to view details about users, groups, or other identity-related entities
* **Build (read) \[vso.build]**: This permission grants read access to information related to builds in Azure DevOps. It allows the user to view details about build pipelines, build definitions, and build execution status
* **Packaging (read) \[vso.packaging]**: This permission grants read access to information related to package management in Azure DevOps. It allows the user to view details about packages, feeds, and package versions stored in Azure Artifacts
* **Extensions (read) \[vso.extension]**: This permission grants read access to information related to extensions in Azure DevOps. It allows the user to view details about installed extensions, extension configurations, and extension marketplace
* **Release (read) \[vso.release]**: This permission grants read access to information related to release pipelines in Azure DevOps. It allows the user to view details about release definitions, release environments, and release execution status
* **Project and team (read) \[vso.project]**: This permission grants read access to information related to projects and teams in Azure DevOps. It allows the user to view details about projects, teams, team membership, and project settings
* **Graph (read) \[vso.graph]**: This permission grants read access to the Azure DevOps Graph API. It allows the user to query and retrieve information about users, groups, and other entities using the Graph API
* **User profile (write) \[vso.profile\_write]**: This permission grants write access to the user’s profile information in Azure DevOps. It allows the user to update their own profile details such as display name, email address, and profile picture
* **Work items (read and write) \[vso.work\_write]**: This permission grants read and write access to work items in Azure DevOps. It allows the user to view, create, update, and delete work items such as user stories, bugs, tasks, and epics
* **Code (read and write) \[vso.code\_write]**: This permission grants read and write access to source code repositories in Azure DevOps. It allows the user to view, create, modify, and delete source code files, branches, and pull requests
* **Task Groups (read, create) \[vso.taskgroups\_write]**: This permission grants read and create access to task groups in Azure DevOps. It allows the user to view existing task groups and create new ones for use in pipelines
* **Code (status) \[vso.code\_status]**: This permission grants access to the status of source code repositories in Azure DevOps. It allows the user to view the status of commits, branches, and pull requests, including build and test status
A repository can be assigned to multiple integrations. However, if all the integrations associated with a repository lack the necessary permissions, many of the actions performed on that repository may fail.
### CI/CD Module Permissions
For CI/CD module support, a phase that is not mandatory for creating a PAT (Personal Access Token) has been added. This token contains the following permissions relevant to the CI/CD module:
* **Member of Project Collection Administrators**: Required to subscribe to the `build.complete` event and download the permissions report for CI/CD scans. As **Organization** owners are automatically part of this group, they also possess this permission
* **Agent Pools (Read)**: Grants access to view information about agent pools used for CI/CD pipelines
* **Analytics (Read)**: Provides access to view analytics data related to CI/CD pipelines and their performance
* **Auditing (Read Audit Log)**: Allows access to read the audit log, which records actions and events related to CI/CD processes for auditing purposes
* **Member Entitlement Management (Read)**: Grants access to view and manage member entitlements related to CI/CD features and resources
* **Pull Request Threads (Read & write)**: Provides permissions to view and interact with pull request threads, including adding comments and making modifications
* **Service Connections (Read)**: Allows access to view service connections configured for CI/CD pipelines, which are used to connect to external services and resources
* **Tokens (Read & manage)**: Grants permissions to view and manage tokens used for authentication and authorization in CI/CD processes
* **Variable Groups (Read)**: Provides access to view variable groups, which contain sets of variables used in CI/CD pipelines for configuring and parameterizing builds and releases
## Subscribed Events
Below is a comprehensive list of events to which Prisma Cloud is subscribed. These events encompass various actions and changes occurring within your Azure Repos environment that trigger notifications and integrations with Prisma Cloud.
**Repositories**
* **git.pullrequest.created**: This event is triggered when a new pull request is created in a Git repository. It allows systems to be notified whenever a new pull request is initiated, enabling integration with other services or actions
* **git.pullrequest.updated**: This event is triggered when an existing pull request is updated with new changes, comments, or other modifications. It allows systems to stay synchronized with the latest changes in pull requests
* **git.push**: This event is triggered when new commits are pushed to a Git repository. It enables systems to track changes to the repository and perform actions such as triggering builds or running tests
* **git.pullrequest.merged**: This event is triggered when a pull request is successfully merged into the target branch. It allows systems to take action after a pull request has been merged, such as deploying changes or updating related tasks
**Organizations**:
* **build.complete**: This event is triggered when a build process is completed within an Azure DevOps organization. It allows systems to react to the completion of build tasks, such as notifying stakeholders or triggering subsequent stages in a deployment pipeline
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/add-azurerepos.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.