Azure DevOps

Trustle’s Azure DevOps integration has two operating modes. Read-only mode gives Trustle updates on work item status and ends access when a linked work item closes. Read/write mode also lets Trustle create, modify, and close work items in Azure DevOps.

Prerequisites

• Permission to create a connection in Trustle.
• Permission to create service hook subscriptions in your Azure DevOps projects.
• For read/write mode, permission to create an app registration in the Azure portal and to add users in Azure DevOps organization settings.

Configure Azure DevOps

Step 1: Enable Azure DevOps Read-Only

Read-only mode ends access early when a linked work item closes. Trustle never calls the Azure DevOps API in this mode.

1. In Trustle, create an Azure DevOps connection. Enter the organization slug exactly as it appears in dev.azure.com/<organization>. Trustle refuses a webhook whose payload names a different organization.
2. Copy the webhook URL and the one-time secret from the response.

   Caution

   Trustle shows the secret once. To replace a lost secret, use the rotate-secret endpoint and update every subscription by hand.

3. In Azure DevOps, open Project settings > Service hooks. Create two Web Hooks subscriptions: one for workitem.created and one for workitem.updated.
4. On each subscription, set the URL to the Trustle webhook URL. Add the custom header X-Api-Key: <secret>.
5. Repeat the previous two steps for every project in scope. Subscriptions are per project. All subscriptions post to the same URL with the same secret.

A requester pastes a work item URL into the access request reason. Trustle stores the link. When that work item closes, Trustle ends the access before its requested expiry.

Note

Azure DevOps service hooks do not support HMAC signing. The per-webhook secret is the only credential. This is safe because an inbound payload can only narrow access, never grant it.

Step 2: Enhance Trustle with Azure DevOps Read/Write (optional)

Read/write mode comments on work items, sets a status on approve or deny, and can open a work item for a request that cites none. This mode is off by default.

Create the app in Azure

1. In the Azure portal, create an App registration (an Entra service principal).
2. In API permissions, add a new permission: Azure DevOps : user_impersonation.
3. Create a client secret.
4. Save three values: the tenant ID, the application (client) ID, and the client secret.
5. Enter these three values in Trustle as the connection’s credentials.

Give the app permission in Azure DevOps

1. Open Organization settings > Users > Add users.
2. Paste the application (client) ID. Do not paste the object ID.
3. Set the access level to Basic.
4. Add the app to the projects Trustle must write to.

Enable write-back

1. In Trustle, turn on write-back on the connection. Configure the project, the work item type, the status names for approved and denied, and the default assignee.
2. Optionally, assign all tickets to a designated user. If every access request must create a ticket, toggle Open a ticket for every request.

Verify

1. Close a work item that a requester linked to an access request.
2. Confirm Trustle ends the linked access before its requested expiry.
3. If read/write mode is on, approve or deny a request and confirm Trustle sets the configured status on the linked work item.