Connect Azure DevOps with Microsoft Entra ID

To enable users to work with a remote Git repository that is hosted on Microsoft Azure Repos:

Set up an application in Microsoft Entra ID.
Apply the Microsoft Entra ID App Secret.

Microsoft Entra ID replaces the deprecated Azure DevOps OAuth 2.0 application, which no longer accepts new registrations. If you have an existing Azure DevOps OAuth app, migrate to Microsoft Entra ID.

Create a Microsoft Entra ID application for Che

Create a Microsoft Entra ID application so that Che can authenticate your developers and provide credential-free access to Azure DevOps repositories.

Prerequisites

You are logged in to Microsoft Azure DevOps Services.

Third-party application access via OAuth is enabled for your organization. See Change application connection & security policies for your organization.
Procedure
1. Register an application in Microsoft Entra ID. See Register an application.
2. Add the Authorization callback URL https://<che_fqdn>/api/oauth/callback to your application. See Add a redirect URI.
3. Add a client secret to your application. See Add credentials.
4. Add the Azure DevOps vso.code_write permission to the client application. See Add permissions to access your web API.
5. Connect your Azure DevOps organization to Microsoft Entra ID. See Connect your organization to Microsoft Entra ID.

Additional resources

Connect Che to your Microsoft Entra ID application

Connect Che to your Microsoft Entra ID application so that developers can access Azure DevOps repositories from workspaces without re-entering credentials.

Prerequisites

You have configured the Microsoft Entra ID OAuth App.
You have the following values, which were generated when configuring the Microsoft Entra ID OAuth App:
- Application (client) ID
- Directory (tenant) ID
- Client Secret
An active kubectl session with administrative permissions to the destination Kubernetes cluster. See Overview of kubectl.

Procedure

Prepare the Secret:

kind: Secret
apiVersion: v1
metadata:
  name: azure-devops-oauth-config
  namespace: eclipse-che(1)
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
    app.kubernetes.io/component: oauth-scm-configuration
  annotations:
    che.eclipse.org/oauth-scm-server: azure-devops
type: Opaque
stringData:
  tenant-id: <Microsoft_Entra_ID_Tenant_ID>(2)
  id: <Microsoft_Entra_ID_App_ID>(3)
  secret: <Microsoft_Entra_ID_Client_Secret>(4)

1	The Che namespace. The default is `eclipse-che`.
2	The Microsoft Entra ID Directory (tenant) ID.
3	The Microsoft Entra ID Application (client) ID.
4	The Microsoft Entra ID Client Secret.

Apply the Secret:

$ kubectl apply -f - <<EOF
<Secret_prepared_in_the_previous_step>
EOF

Verification

Verify that the output displays secret/azure-devops-oauth-config created.
Verify that the rollout of the Che server components is complete:
```
$ kubectl rollout status deployment/che -n eclipse-che
```