New Azure DevOps scopes now available for Microsoft Identity OAuth delegated flow apps
Sep 28, 2023Angel Wong
Summary
Introduced new, granular Azure DevOps scopes for delegated OAuth apps on the Microsoft Identity platform. Previously, only the `user_impersonation` scope was available, granting full access to all Azure DevOps APIs. The new scopes allow apps to request and access only the specific APIs granted by the requested permissions, enhancing security for delegated flows. This brings Azure AD OAuth apps in parity with Azure DevOps OAuth regarding scopes. Existing apps with `user_impersonation` are encouraged to down-scope to reduce risk.
More from the Azure DevOps Service Connection with Microsoft Entra trail
- You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token
- Retirement of Azure DevOps issuer in Workload identity federation service connections
- Optimizing Git policy management at scale
- Azure DevOps MCP Server April Update
- One-click security scanning and org-wide alert triage come to Advanced Security