> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/connectors/azure.md).

# Azure DevOps

## Overview

The Azure DevOps connector links your Azure DevOps organization to Nullify so that source-control activity drives security scanning, pull request reviews, and two-way ticket status sync — without developers leaving their existing workflow.

Nullify authenticates to Azure DevOps with the OAuth client-credentials flow (Client ID, Client Secret, and Tenant ID), then subscribes to Azure DevOps **service hooks** that deliver Git and work-item events to Nullify over an authenticated webhook.

{% hint style="warning" %}
Azure DevOps integration is not currently available on the production Nullify platform. Service hooks created from the Nullify dashboard or manually will not be delivered until this is enabled for your tenant. Contact your Nullify representative before following this guide.
{% endhint %}

{% hint style="info" %}
This page describes what the integration provides. For the step-by-step setup — registering the Azure app, granting permissions, and creating the webhooks — see the [Azure DevOps Install guide](/enterprise-tier/azure-install.md).
{% endhint %}

## What you get

### Pull request reviews

When a pull request is **created** or **updated** in a connected repository, Nullify reviews the changed code and posts its findings back as a PR review. Replies to Nullify's PR comments are also handled: when a developer comments on a Nullify review thread, the connector picks up the reply and continues the conversation in-thread.

Pull request gating and review behaviour are configured in the dashboard under **Configure → Pull Requests** (or via the admin API), including whether the "Nullify" check can fail the build on net-new findings at or above your chosen priority threshold.

{% hint style="info" %}
Nullify does not open autofix pull requests on Azure DevOps — autofix PR creation is currently available on other Git platforms. The Azure connector covers PR reviews, push scanning, and ticket sync.
{% endhint %}

### Push scanning

Every push to a connected repository is delivered to Nullify. The connector emits a scan event for each updated branch (tag pushes and branch deletions are ignored), and pushes to the repository's default branch additionally trigger the default-branch pipeline so your baseline security posture stays current.

### Work-item (ticketing) status sync

When Nullify files a finding as an Azure DevOps work item, **work-item updated** events flow back to Nullify. A state change on a tracked work item (for example moving it to *Resolved*, *Closed*, or *Done*) is synced to the matching Nullify finding ticket, keeping the finding's status aligned with what your team does in Azure Boards. Nullify maps Azure's out-of-the-box state vocabulary by default and honours a per-tenant status map for teams running a custom Azure Boards process.

## Events the connector subscribes to

Nullify creates Azure DevOps service-hook subscriptions for the following events on each connected repository:

| Event                  | Azure DevOps trigger                        | Used for                                      |
| ---------------------- | ------------------------------------------- | --------------------------------------------- |
| Code pushed            | `git.push`                                  | Push scanning (all branches + default branch) |
| Pull request created   | `git.pullrequest.created`                   | PR reviews                                    |
| Pull request updated   | `git.pullrequest.updated`                   | PR reviews                                    |
| Pull request commented | `ms.vss-code.git-pullrequest-comment-event` | PR review replies                             |
| Work item updated      | `workitem.updated`                          | Ticket status sync                            |

Webhook deliveries are authenticated: each subscription carries an HTTP Basic credential (username `nullify` plus a per-install shared secret), and Nullify rejects deliveries that don't match.

## Setup

Subscriptions can be created for you from the Nullify dashboard across the whole organization or per repository, or configured manually in Azure DevOps. The full walkthrough lives in the [Azure DevOps Install guide](/enterprise-tier/azure-install.md).