# Azure Devops Connctor - Create functionality **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** identityiq\ **Created:** [July 29, 2026, 11:09am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621 "2026-07-29T11:09:20Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Richie1997](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/richie1997/32/39514_2.png) [@Richie1997](https://developer.sailpoint.com/discuss/u/Richie1997)\ **Post date:** [July 29, 2026, 11:09am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/1 "2026-07-29T11:09:20Z")
## Which IIQ version are you inquiring about? _8.3P_ ## Please share any images or screenshots, if relevant. ![IMG_2345](https://global.discourse-cdn.com/sailpoint/original/3X/0/2/02983e036e08653daab434c764207aa6b8490f29.jpeg) ## ## Share all details about your problem, including any error messages you may have received. _Hi Sailors, I am working on onboarding the Azure DevOps connector application for the first time. I completed the aggregation part without any issue; now I am working on the provisioning part. Here I tested adding and removing entitlements of existing Azure DevOps application users; it’s working fine. But while I am trying to add a new user to that Azure DevOps application, I am facing the above issue, which I posted in the image. I checked a PAT scope; it’s having a graph read & managed. So I need help here. Thanks in advance._ ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [July 29, 2026, 11:25am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/2 "2026-07-29T11:25:43Z")
@Richie1997 I think you also need to have “Member Entitlement Management” scopes as well, specifically 'memberentitlementmanagement\_write" or “identity\_manage”. Ref: [User Entitlements - Update User Entitlement - REST API (Azure DevOps Member Entitlement Management) | Microsoft Learn](https://learn.microsoft.com/en-us/rest/api/azure/devops/memberentitlementmanagement/user-entitlements/update-user-entitlement?view=azure-devops-rest-7.1&tabs=HTTP) > **[Azure DevOps User Management API Guide | Stitchflow](https://www.stitchflow.com/user-management/azure-devops/api)** > > API guide for Azure DevOps user lifecycle automation, auth, endpoints, and caveats. ---
**Author:** ![Richie1997](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/richie1997/32/39514_2.png) [@Richie1997](https://developer.sailpoint.com/discuss/u/Richie1997)\ **Post date:** [July 29, 2026, 1:10pm UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/3 "2026-07-29T13:10:06Z")
Hi @neel193 Thanks for your reply. Yes currently I enabled both member entitlement and identity manage scope also. Still I am ending up with same error. ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [July 29, 2026, 1:17pm UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/4 "2026-07-29T13:17:11Z")
Ok. Do you know if “Allow team and project administrators to invite new users” policy is enabled. This is as per: [Restrict administrators from inviting new users - Azure DevOps Services | Microsoft Learn](https://learn.microsoft.com/en-us/azure/devops/organizations/security/restrict-invitations?view=azure-devops) ---
**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\ **Post date:** [July 30, 2026, 1:36am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/5 "2026-07-30T01:36:03Z")
> [@Richie1997](#): > > am working on onboarding the Azure DevOps connector application for the first time. I completed the aggregation part without any issue; now I am working on the provisioning part. Here I tested adding and removing entitlements of existing Azure DevOps application users; it’s working fine. But while I am trying to add a new user to that Azure DevOps application, I am facing the above issue, which I posted in the image. I checked a PAT scope; it’s having a graph read & managed. So I need help here. Thanks in advance. The issue is Azure DevOps has an org-level policy called **“Restrict administrators from inviting new users.”** By default, Team and Project Administrators are blocked from inviting brand-new users into the organization — only a **Project Collection Administrator (PCA)** can add a new user. Project Collection Administrators can still add new users to the organization regardless of the policy status. This exactly matches your error text: “you do not have permissions to add new users to the organization… contact a Project Collection Administrator.” Solution: can you add the service account to PCA group — recommended for provisioning to keep working long-term): 1. Go to your azure portal → Organization settings 2. Permissions → Project Collection Administrators 3. Add the identity/service account whose PAT is being used by the IIQ Azure DevOps connector to this group. test it after that ---
**Author:** ![Richie1997](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/richie1997/32/39514_2.png) [@Richie1997](https://developer.sailpoint.com/discuss/u/Richie1997)\ **Post date:** [July 30, 2026, 6:17am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/6 "2026-07-30T06:17:31Z")
@naveenkumar3 Thanks for your reply. You are correct and your solution is perfect match for my issue. – \> May I now how you are handling PAT token via cyberark? → PAT token having valid of 30 days only in my org how to overcome this issue any idea ? ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [July 30, 2026, 7:51am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/7 "2026-07-30T07:51:24Z")
@Richie1997 Would recommend reading the article shared here to understand how you can disable the restricting policy to allow your PCA account to create new users. You can save PAT tokens in CyberArk by creating a privileged account object followed by updating Credential Configuration update in IIQ .. but the problem which you’ll face is on the expiration. AFAIK there is no module available within CyberArk that natively support PAT rotation for Azure DevOps. Also as per Microsoft Blogs PAT is getting decommissioned on 1 Dec 2026: [Retirement of Global Personal Access Tokens in Azure DevOps - Azure DevOps Blog](https://devblogs.microsoft.com/devops/retirement-of-global-personal-access-tokens-in-azure-devops/) So, it would be better if you move to Service Principal Name as this is a recommended approach going forward by Microsoft. Steps to switch to Service Principal: - Register an App Registration in Microsoft Entra ID (Azure AD) - Create a Client Secret or use a Certificate - Add the Service Principal to your Azure DevOps organization as a user - Grant it Project Collection Administrator permissions - Configure your SailPoint Web Services connector to use OAuth 2.0 Client Credentials flow instead of PAT Another article where Microsoft is reducing PAT usage across azure devops: [Reducing personal access token (PAT) usage across Azure DevOps - Azure DevOps Blog](https://devblogs.microsoft.com/devops/reducing-pat-usage-across-azure-devops/) ---
**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\ **Post date:** [July 30, 2026, 9:15am UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/8 "2026-07-30T09:15:48Z")
> [@Richie1997](#): > > Thanks for your reply. You are correct and your solution is perfect match for my issue. > – \> May I now how you are handling PAT token via cyberark? > → PAT token having valid of 30 days only in my org how to overcome this issue any idea ? Glad it resolved your issue. mark the post as solution. Regarding your below asks, please find my response two separate things here — CyberArk isn’t actually integrated with the Azure DevOps connector by default, and the 30-day expiry needs a rotation strategy since Azure DevOps doesn’t offer non-expiring PATs. **On CyberArk:** 1. **CyberArk CCP (Central Credential Provider) REST API** called from a **BeforeProvisioningRule / build.xml pre-hook** or a custom **scheduled task** that fetches the current PAT from the CyberArk Safe at runtime and updates the application config attribute (`accessToken`/PAT field) via `Application.setAttribute()` before the connector runs. 2. A scheduled **Rule or external script** (cron/task scheduler) that rotates the PAT in Azure DevOps via its REST API, pushes the new value into CyberArk, and IIQ pulls it from CyberArk at each aggregation/provisioning cycle. On the 30-day PAT expiry — two option i think, 1. **Automate rotation with a scheduled task/rule combo (most common fix):** 2. **Ask your Azure DevOps org admin if the max PAT lifetime policy can be extended** — Microsoft allows PATs up to 1 year by default; a 30-day cap is usually a custom org policy (Organization settings → Policies → “Third-party application access via OAuth” / PAT lifetime policy), so it may be adjustable if there’s no compliance mandate forcing 30 days. ---
**Author:** ![Richie1997](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/richie1997/32/39514_2.png) [@Richie1997](https://developer.sailpoint.com/discuss/u/Richie1997)\ **Post date:** [July 30, 2026, 3:43pm UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/9 "2026-07-30T15:43:03Z")
@naveenkumar3 - Yes I marked as solution. Thanks again. ---
**Author:** ![Richie1997](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/richie1997/32/39514_2.png) [@Richie1997](https://developer.sailpoint.com/discuss/u/Richie1997)\ **Post date:** [July 30, 2026, 3:46pm UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/10 "2026-07-30T15:46:51Z")
@neel193 - Thanks for highlightling this global PAT retirement. Service principal alternative solution also good alternative auth method. But the ADO connector which we are having in my org only support PAT not Entra/ service principal. So that I planned to go with organization specific PAT instead of generating global PAT. Since global PAT only getting retire by DEC 2K26 this ORG specific PAT method will be fine I think. Any thoughts on this ? ---
**Author:** ![neel193](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neel193/32/34038_2.png) [@neel193](https://developer.sailpoint.com/discuss/u/neel193)\ **Post date:** [July 30, 2026, 3:56pm UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/11 "2026-07-30T15:56:32Z")
AFAIK, current versions doesn’t support service principal. You might want to reach out to your CSM well ahead to understand the impact and see if Sailpoint has any plan to provide a patch or something. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [September 28, 2026, 3:57pm UTC](https://developer.sailpoint.com/discuss/t/azure-devops-connctor-create-functionality/217621/12 "2026-09-28T15:57:16Z")
Closed on September 28, 2026, 3:57pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.