Required permissions

Full list of permissions required for integrating Azure DevOps and Azure DevOps Server with Xopero ONE.

Azure DevOps

OAuth app

Xopero supports only organizational accounts (Microsoft Entra ID)— personal accounts are not supported. For private accounts, use PAT instead.

To integrate Azure DevOps with Xopero ONE using OAuth, make sure the account has an administrator role. Otherwise, you may encounter permission errors or find that the approval button is inactive.

When integrating Azure DevOps via OAuth, you'll need to grant the necessary permissions to the Xopero ONE application:

• Wiki: read and write

• Variable Groups: read and create

• Work Items: read and write

• Project and Team: read, write and manage

• Code: read, write and manage

• Build: read and execute

• Environment: read and manage

• Login and read the profile

Personal Access Token (PAT)

Prerequisites:

• Username (not an email address)

• Personal Access Token (when generating PAT you must enable the All accessible organizations value in the Organization field)

Permissions:

• Build: read & execute

• Code: read, write, & manage

• Environment: read & manage

• Project and Team: read, write, & manage

• Variable Groups: read & create

• Wiki: read & write

• Work Items: read & create

When performing a backup with minimal permissions, some metadata might be excluded. To ensure complete protection, select the permissions based on your data protection needs. Note that with read-only permissions, backups can be made, but restoring requires a new token or password with write access.

---

Azure DevOps Server

Personal Access Token (PAT)

Prerequisites:

• Username (not an email address)

• Personal Access Token (when generating PAT you must enable the All accessible organizations value in the Organization field)

Permissions:

• Build: read & execute

• Code: read, write, & manage

• Environment: read & manage

• Project and Team: read, write, & manage

• Variable Groups: read & create

• Wiki: read & write

• Work Items: read & create

When performing a backup with minimal permissions, some metadata might be excluded. To ensure complete protection, select the permissions based on your data protection needs. Note that with read-only permissions, backups can be made, but restoring requires a new token or password with write access.