Required permissions

Full list of permissions required for integrating Azure DevOps and Azure DevOps Server with Xopero ONE.

Required permissions for Azure DevOps and Azure DevOps Server specify the access levels Xopero ONE needs to securely back up and restore your data. To ensure successful operations, permissions must be configured at the User, Organization, Project, and Repository levels.

---

Azure DevOps

User Access Levels

The account used for integration must have an appropriate access level assigned within Azure DevOps:

• Basic.

• Visual Studio Subscriber - Professional or Enterprise tier.

• GitHub Enterprise - similar to basic.

• Stakeholder - not recommended. This level has limited access and cannot properly protect repositories.

Xopero ONE can only protect projects that the integrated user account has explicit access to.

OAuth Integration

Xopero supports only organizational accounts (Microsoft Entra ID)—personal accounts are not supported. For private accounts, use PAT instead.

To integrate Azure DevOps with Xopero ONE using OAuth, make sure the account has an administrator role. Otherwise, you may encounter permission errors or find that the approval button is inactive.

When integrating Azure DevOps via OAuth, the following scopes are required:

• Build: read and execute (vso.build_execute)

• Code: read, write and manage (vso.code_manage)

• Environment: read and manage (vso.environment_manage)

• Projects and teams: read, write and manage (vso.project_manage)

• Variable Groups: read and create (vso.variablegroups_write)

• Wiki: read and write (vso.wiki_write)

• Work Items: read and write (vso.work_write)

• Packaging: read, write and manage (vso.packaging_manage)

• user_impersonation: required for artifacts

• Login and read the profile

Personal Access Token (PAT)

Prerequisites:

• Organization: when generating PAT you must enable the All accessible organizations value in the Organization field

Required scopes:

• Build: read and execute

• Code: read, write and manage

• Environment: read and manage

• Project and Team: read, write and manage

• Variable Groups: read and create

• Wiki: read and write

• Work Items: read and write

• Packaging: read, write and manage

When performing a backup with minimal permissions, some metadata might be excluded. To ensure complete protection, select the permissions based on your data protection needs. Note that with read-only permissions, backups can be made, but restoring requires a new token or password with write access.

---

Granular permission settings

To ensure both backup and restore operations succeed, verify the following settings in your Azure DevOps security configuration.

The following permissions are required:

Organization level

• General:

  • Create new projects (restore)

• Boards:

  • Create process (restore)

  • Edit process (restore)

Project level

• General:

  • View project-level information (backup)

Repositories level

• Create branch (restore)

• Create repository (restore)

• Read (backup)

---

Azure DevOps Server

Personal Access Token (PAT)

For on-premises installations, use the Personal Access Token (PAT) method.

Prerequisites:

• Organization: when generating PAT you must enable the All accessible organizations value in the Organization field

Required scopes:

• Build: read and execute

• Code: read, write and manage

• Environment: read and manage

• Project and Team: read, write and manage

• Variable Groups: read and create

• Wiki: read and write

• Work Items: read and write

• Packaging: read, write and manage

When performing a backup with minimal permissions, some metadata might be excluded. To ensure complete protection, select the permissions based on your data protection needs. Note that with read-only permissions, backups can be made, but restoring requires a new token or password with write access.