Skip to main content

Set up the remote Azure DevOps MCP server

Microsoft's remote Azure DevOps MCP server lets AI agents work with Azure DevOps: reading and updating work items, reviewing pull requests, running pipelines, and searching wikis and code, all under each user's own permissions. This guide covers preparing your Microsoft Entra tenant, registering a Microsoft Entra app for OAuth, and connecting the server to MintMCP from the recommended server catalog.

Prerequisites​

  • A MintMCP admin account
  • An Azure DevOps Services organization connected to a Microsoft Entra tenant
  • Application Administrator, Cloud Application Administrator, or Global Administrator in that tenant
  • Users need a work or school account in the tenant and membership in the Azure DevOps organization

Provision the Azure DevOps MCP application​

The remote server's API is published by the Azure DevOps MCP enterprise application, which isn't created in your tenant automatically, so an admin must add it before its permissions can be granted.

  1. Sign in to the Azure portal and open Cloud Shell (Bash) from the top bar.

  2. Run:

    az ad sp create --id 2a72489c-aab2-4b65-b93a-a91edccf33b8

  3. Confirm the output includes "displayName": "Azure DevOps MCP".

Register a Microsoft Entra app​

Microsoft Entra does not support dynamic client registration, so an admin registers an app once and MintMCP uses its client ID and secret for the OAuth flow.

  1. Go to portal.azure.com > Microsoft Entra ID > App registrations.

    Azure portal Default Directory blade with Microsoft Entra ID highlighted in the left sidebar and App registrations selected under Manage

  2. Click New registration.

    Azure portal App registrations page with the New registration button highlighted in the top toolbar

  3. Enter a name, for example MintMCP Azure DevOps, and under Supported account types, select Single tenant only.

  4. Under Redirect URI (optional), select Web and enter the redirect URI for your MintMCP region:

    MintMCP regionRedirect URI
    UShttps://app.mintmcp.com/oauth/callback
    EUhttps://eu.mintmcp.com/oauth/callback
    Register an application form with Name set to MintMCP Azure DevOps, Single tenant account type, and a Web redirect URI of https://app.mintmcp.com/oauth/callback

  5. Click Register.

  6. Go to API permissions > Add a permission > APIs my organization uses, and search for 2a72489c-aab2-4b65-b93a-a91edccf33b8.

  7. Select Azure DevOps MCP > Delegated permissions, and add Ado.Mcp.Tools plus the permissions for the areas your team needs:

    PermissionGrants
    Ado.Mcp.ToolsAccess to the remote MCP server tools
    repos.read / repos.writeRead, or read and update, repositories, branches, and pull requests
    wit.read / wit.writeRead, or read and update, work items, comments, and links
    wiki.read / wiki.writeRead, or read and update, wiki pages
    pipelines.read / pipelines.writeRead, or read and queue, builds and pipelines
    work.read / work.writeRead, or read and update, iterations, capacity, and team settings
    testplan.read / testplan.writeRead, or read and update, test plans, suites, and results
    advsec.readRead Advanced Security alerts

    Select Azure DevOps MCP, not Azure DevOps. The Azure DevOps API (user_impersonation) issues tokens the remote server rejects.

  8. Click Grant admin consent and confirm, so users are not individually prompted to consent.

    API permissions page with the Grant admin consent for Default Directory button and the grant admin consent confirmation dialog showing Yes and No

  9. Go to Certificates & secrets > Client secrets > New client secret.

    Certificates & secrets page with the Client secrets tab selected and the New client secret button

  10. Enter a description and expiry, then click Add.

    Add a client secret panel with a Description and Expires field and the Add button

  11. Copy the secret Value immediately, because it isn't shown again.

    Client secrets table showing a secret with its Value column and copy button

  12. On the Overview page, copy the Application (client) ID.

    App registration Overview tab showing the Essentials panel with Application (client) ID and Directory (tenant) ID

Add Azure DevOps to MintMCP​

Azure DevOps (Remote) is listed in the MintMCP recommended server catalog. Because Entra does not support dynamic client registration, you supply the client ID and secret from the app you registered above.

  1. In MintMCP, go to MCP store > Manage store.
  2. Find Azure DevOps (Remote) in the recommended servers list and click Install.
  3. Under OAuth Client Advanced Settings, paste the Application (client) ID in the Client ID field and the secret Value in the Client Secret field.
  4. Click Install.

Each user signs in with their own Microsoft account on first use, so tool calls run under their identity and Azure DevOps permissions.

Available tools​

Tool groupWhat it does
CoreLists organizations, projects, and teams
Work itemsReads, creates, and updates work items, queries, comments, and links
RepositoriesReads repositories, branches, files, and commits, and manages pull requests
PipelinesReads builds, logs, and artifacts, and queues pipeline runs
WikiReads and updates wiki pages
WorkReads and updates iterations and team capacity
Test plansReads and updates test plans, suites, cases, and runs
Advanced SecurityReads Advanced Security alerts
SearchRuns full-text search across code, work items, and wikis

If you want to limit what users can reach, disable tools with tool customization.

Troubleshooting​

  • AADSTS700016: the sign-in went to a tenant that doesn't contain the app. Sign in with an account from the tenant where you registered the app.
  • AADSTS650057: the app has no Azure DevOps MCP permissions, usually because the Azure DevOps API was added instead. Add the Azure DevOps MCP permissions and grant admin consent.
  • Azure DevOps MCP doesn't appear under APIs my organization uses: the enterprise application isn't provisioned. Run the az ad sp create command above, then search by ID again.
  • invalid_grant after signing in: the token exchange failed. Check that the redirect URI uses the Web platform and that MintMCP has the secret Value, not the Secret ID.
  • No organizations or projects returned: the user isn't a member of an Azure DevOps organization connected to the tenant. Add them under Organization settings > Users.

Security considerations​

  • Each user authenticates with their own Microsoft account, so tool calls are bounded by their Azure DevOps permissions.
  • The delegated permissions you consent to cap what any user can do through MintMCP. Grant only the .read permissions for a read-only deployment.
  • Client secrets expire after at most 24 months. Add a new secret and update it in MintMCP before the old one expires, or every connection fails.
  • Entra Conditional Access policies apply to these sign-ins the same way they apply to Azure DevOps.
  • All tool calls flow through the MintMCP gateway, so they are attributed to individual users in the audit log.

Next steps​