Skip to content

Update Azure DevOps Oauth configuration instructions #3036

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
svor merged 6 commits into from
Apr 8, 2026
Merged

Update Azure DevOps Oauth configuration instructions #3036

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9cd4713
Update Azure DevOps Oauth configuration instructions
vinokurig Mar 11, 2026
4f4efc1
Update modules/administration-guide/partials/proc_setting-up-the-micr…
vinokurig Mar 27, 2026
3c6c1e0
Update modules/administration-guide/partials/proc_setting-up-the-micr…
vinokurig Mar 27, 2026
ef094d1
Update modules/administration-guide/partials/proc_applying-the-micros…
vinokurig Mar 27, 2026
8a21918
Update modules/administration-guide/partials/proc_applying-the-micros…
vinokurig Mar 27, 2026
8a85ba2
fixup! Update modules/administration-guide/partials/proc_applying-the…
vinokurig Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions ...ration-guide/pages/configuring-oauth-2-for-microsoft-azure-devops-services.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,13 @@ To enable users to work with a remote Git repository that is hosted on Microsoft

pass:[<!-- vale RedHat.Spelling = YES -->]

. Set up the Microsoft Azure DevOps Services OAuth App (OAuth 2.0).
. Apply the Microsoft Azure DevOps Services OAuth App Secret.
. Set up an application in Microsoft Entra ID.
Copy link
Copy Markdown
Contributor

@gtrivedi88 gtrivedi88 Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The assembly title (line 8), :description: (line 2), :navtitle: (line 4), and [id=...] (line 7) still reference "Microsoft Azure DevOps Services" but the procedures now use Microsoft Entra ID. Update these to align with the new flow.

Also: the two removed [IMPORTANT] blocks mentioned OAuth 2.0 deprecation and Azure DevOps Server limitations. Should the assembly introduction note that Microsoft Entra ID replaces the deprecated OAuth 2.0 app registration?

Copy link
Copy Markdown
Contributor Author

@vinokurig vinokurig Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The assembly title (line 8), :description: (line 2), :navtitle: (line 4), and [id=...] (line 7) still reference "Microsoft Azure DevOps Services" but the procedures now use Microsoft Entra ID. Update these to align with the new flow.

Configuring OAuth 2.0 for Microsoft Azure DevOps Services is still relevant because we do not mention the specific oauth application here. OAuth 2.0 here is a general name for oauth applications (Azure DevOps oauth application or Microsoft OIDC oauth application).

Copy link
Copy Markdown
Contributor Author

@vinokurig vinokurig Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also: the two removed [IMPORTANT] blocks mentioned OAuth 2.0 deprecation and Azure DevOps Server limitations. Should the assembly introduction note that Microsoft Entra ID replaces the deprecated OAuth 2.0 app registration?

These instructions are supposed to help configure OAuth for Azure DevOps. Creating new Azure OAuth apps is no longer available, so why is there a need to mention it?

Copy link
Copy Markdown
Contributor

@gtrivedi88 gtrivedi88 Apr 6, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right that the procedures should focus on the new Entra ID path only. However, @svor raised a valid concern via eclipse-che/che#23785, existing users with old Azure DevOps OAuth apps need to know it's deprecated.

Can we add a brief [NOTE] in the assembly introduction (not in the procedures)?

[NOTE]
====
Microsoft Entra ID replaces the deprecated Azure DevOps OAuth 2.0 app registration, which no longer accepts new registrations. If you have an existing Azure DevOps OAuth app, migrate to Microsoft Entra ID.
====

This addresses the migration concern without cluttering the procedure steps. WDYT?

Copy link
Copy Markdown
Contributor Author

@vinokurig vinokurig Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done, added the note

. Apply the Microsoft Entra ID App Secret.

[IMPORTANT]
OAuth 2.0 isn't supported on Azure DevOps Server, see link:https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops[the documentation page].
[IMPORTANT]
Azure DevOps OAuth 2.0 is deprecated and no longer accepts new registrations, with full deprecation planned for 2026. See link:https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops[the documentation page].
[NOTE]
====
Microsoft Entra ID replaces the deprecated Azure DevOps OAuth 2.0 application, which no longer accepts new registrations. If you have an existing Azure DevOps OAuth app, migrate to Microsoft Entra ID.
====

include::partial$proc_setting-up-the-microsoft-azure-devops-services-oauth-app.adoc[leveloffset=+1]

Expand Down
29 changes: 16 additions & 13 deletions ...artials/proc_applying-the-microsoft-azure-devops-services-oauth-app-secret.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,20 +1,21 @@
:_content-type: PROCEDURE
:description: Applying the Microsoft Azure DevOps Services OAuth App Secret
:keywords: microsoft-azure-devops-services-oauth-app, apply, secret
:navtitle: Applying the Microsoft Azure DevOps Services OAuth App Secret
:description: Applying the Microsoft Entra ID OAuth App Secret
:keywords: microsoft-azure-devops-entra-id-oauth-app, apply, secret
:navtitle: Applying the Microsoft Entra ID OAuth App Secret
// :page-aliases:

[id="applying-the-microsoft-azure-devops-services-oauth-app-secret"]
= Applying the Microsoft Azure DevOps Services OAuth App Secret
[id="applying-the-microsoft-entra-id-oauth-app-secret"]
= Applying the Microsoft Entra ID OAuth App Secret

Prepare and apply the Microsoft Azure DevOps Services Secret.
Prepare and apply the Secret that enables {prod-short} to authenticate with Microsoft Entra ID for Azure DevOps repository access.

.Prerequisites

* Setting up the Microsoft Azure DevOps Services OAuth App is completed.
* You have set up the Microsoft Entra ID OAuth App.

* The following values, which were generated when setting up the Microsoft Azure DevOps Services OAuth App, are prepared:
** *App ID*
* The following values, which were generated when setting up the Microsoft Entra ID OAuth App, are prepared:
** *Application (client) ID*
** *Directory (tenant) ID*
** *Client Secret*

* An active `{orch-cli}` session with administrative permissions to the destination {orch-name} cluster. See {orch-cli-link}.
Expand All @@ -37,12 +38,14 @@ metadata:
che.eclipse.org/oauth-scm-server: azure-devops
type: Opaque
stringData:
id: __<Microsoft_Azure_DevOps_Services_OAuth_App_ID>__# <2>
secret: __<Microsoft_Azure_DevOps_Services_OAuth_Client_Secret>__# <3>
tenant-id: __<Microsoft_Entra_ID_Tenant_ID>__# <2>
id: __<Microsoft_Entra_ID_App_ID>__# <3>
secret: __<Microsoft_Entra_ID_Client_Secret>__# <4>
----
<1> The {prod-short} namespace. The default is `{prod-namespace}`.
<2> The Microsoft Azure DevOps Services OAuth *App ID*.
<3> The Microsoft Azure DevOps Services OAuth *Client Secret*.
<2> The Microsoft Entra ID *Directory (tenant) ID*.
<3> The Microsoft Entra ID *Application (client) ID*.
<4> The Microsoft Entra ID *Client Secret*.

. Apply the Secret:
+
Expand Down
33 changes: 10 additions & 23 deletions ...ide/partials/proc_setting-up-the-microsoft-azure-devops-services-oauth-app.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
:_content-type: PROCEDURE
:description: Setting up the Microsoft Azure DevOps Services OAuth App
:description: Setting up the Microsoft Entra ID OAuth App
:keywords: azure, devops, oauth
:navtitle: Setting up the Microsoft Azure DevOps Services OAuth App
:navtitle: Setting up the Microsoft Entra ID OAuth App
// :page-aliases:

pass:[<!-- vale RedHat.TermsWarnings = NO -->]

[id="setting-up-the-microsoft-azure-devops-services-oauth-app"]
= Setting up the Microsoft Azure DevOps Services OAuth App
[id="setting-up-the-microsoft-entra-id-oauth-app"]
= Setting up the Microsoft Entra ID OAuth App

Set up a Microsoft Azure DevOps Services OAuth App using OAuth 2.0.
Set up a Microsoft Entra ID OAuth App to enable {prod-short} users to interact with Azure DevOps Git repositories without re-entering credentials.

.Prerequisites

Expand All @@ -23,24 +23,11 @@ Set up a Microsoft Azure DevOps Services OAuth App using OAuth 2.0.

.Procedure

. Visit link:https://app.vsaex.visualstudio.com/app/register/[].

. Enter the following values:

.. *Company name*: `{prod-short}`
.. *Application name*: `{prod-short}`
.. *Application website*: `pass:c,a,q[{prod-url}]/`
.. *Authorization callback URL*: `pass:c,a,q[{prod-url}]/api/oauth/callback`

. In *Select Authorized scopes*, select *Code (read and write)*.

. Click *Create application*.

. Copy and save the *App ID* for use when applying the Microsoft Azure DevOps Services OAuth App Secret.

. Click *Show* to display the *Client Secret*.

. Copy and save the *Client Secret* for use when applying the Microsoft Azure DevOps Services OAuth App Secret.
. Register an application in Microsoft Entra ID. See link:https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app[Register an application].
. Add the *Authorization callback URL* `pass:c,a,q[{prod-url}]/api/oauth/callback` to your application. See link:https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-redirect-uri[Add a redirect URI].
. Add a client secret to your application. See link:https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials?tabs=client-secret[Add credentials].
. Add the Azure DevOps `vso.code_write` permission to the client application. See link:https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis#add-permissions-to-access-your-web-api[Add permissions to access your web API].
. Connect your Azure DevOps organization to Microsoft Entra ID. See link:https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/connect-organization-to-azure-ad?view=azure-devops#connect-your-organization-to-microsoft-entra-id-1[Connect your organization to Microsoft Entra ID].

pass:[<!-- vale RedHat.TermsWarnings = YES -->]

Expand Down
Loading