> ## Documentation Index
> Fetch the complete documentation index at: https://docs.synq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure DevOps Integration

> Add SSH keys to Azure DevOps Repos for Coalesce Quality

## Overview

This guide covers how to add the generated public SSH key to Azure DevOps Repos for repository access.

<Info>
  **Before you start:** Create your Git integration first by following the [integration form instructions](/code-integrations/overview#configuring-the-integration). You'll need the public SSH key from that integration.
</Info>

## Prerequisites

* Access to Azure DevOps
* **Read permissions** on the repository you want to integrate
* Public SSH key from your Git integration
* A service account or user account to add the SSH key to

<Note>
  ⏱️ **Estimated time:** 10 minutes
</Note>

<Warning>
  **Important:** Azure DevOps does not support repository-level deploy keys. You must use a service account or user account with SSH keys. The account should have **Read** permissions only on the repository.
</Warning>

## IP Whitelisting (If Required)

If your Azure DevOps organization uses IP restrictions, add the Coalesce Quality egress IP addresses for your region. See [IP Whitelist](/security/ip) for the complete list.

For instructions on configuring IP restrictions in Azure DevOps, see Azure DevOps' guide on [IP address restrictions](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/change-application-access-policies).

## Setting Up SSH Access

### Step 1: Create or Use a Service Account

1. Create a dedicated service account (recommended) or use an existing account
2. Grant the account **Read** permissions on the repository:
   * Navigate to **Project Settings > Repositories**
   * Select your repository
   * Go to **Security** tab
   * Add the service account with **Read** permission only

<Note>
  Using a dedicated service account makes it easier to audit and revoke access if needed.
</Note>

### Step 2: Add SSH Public Key

1. Sign in to Azure DevOps with the service account
2. Click on your **User settings** icon (top right)
3. Select **SSH public keys**
4. Click **+ New Key**
5. Configure the SSH key:
   * **Name:** Enter a descriptive name (e.g., `Coalesce Quality Integration`)
   * **Public Key Data:** Paste the complete public SSH key from your integration

<Warning>
  Make sure to paste the **complete key** including the `ssh-rsa` or `ssh-ed25519` prefix.
</Warning>

6. Click **Add**

The SSH key is now active for this account.

### Step 3: Verify Repository Access

Ensure the service account has access to the specific repository:

1. Navigate to **Project Settings > Repositories**
2. Select your repository
3. Go to **Security** tab
4. Verify the service account is listed with **Read** permissions

## Repository URL Format

When configuring the integration, use the Azure DevOps SSH URL format:

**Format:** `git@ssh.dev.azure.com:v3/organization/project/repository`

**Example:** `git@ssh.dev.azure.com:v3/mycompany/DataPlatform/analytics-repo`

<Note>
  The URL format for Azure DevOps SSH is different from other Git providers. Make sure to use the exact format shown above with `ssh.dev.azure.com:v3/`. This is automatically converted to `dev.azure.com` for the web URL.
</Note>

### Commit URL Format

For most Azure DevOps instances, the correct commit URL format is detected automatically. If auto-detection doesn't work for your setup, you can specify it manually in the integration form.

**Recommended format (works with all Azure DevOps instances):**

`{web_url}/commit/{hash}`

The `{web_url}` placeholder automatically resolves to your full repository web URL including organization, project, and repository components.

**Alternative explicit format:**

`https://dev.azure.com/{owner}/{name}/commit/{hash}`

Note: This format may not work correctly if the project and repository cannot be properly parsed from your SSH URL. Use the `{web_url}` format for better reliability.

### Finding Your Repository URL

To find your repository's SSH URL:

1. Go to your repository in Azure DevOps
2. Click **Clone** button (top right)
3. Select **SSH** tab
4. Copy the URL (it will be in the format above)

## Troubleshooting

### SSH key not working

* Verify the **complete public key** was copied (including the `ssh-rsa` or `ssh-ed25519` prefix)
* Ensure the SSH key was added to the **correct user/service account**
* Confirm the account has **Read** permissions on the repository

### Connection refused

* Check that your organization's **IP restrictions** (if configured) include the Coalesce Quality egress IPs
* Verify the repository **SSH URL** uses the correct format: `git@ssh.dev.azure.com:v3/org/project/repo`
* Ensure the URL has `v3` in the path (required for Azure DevOps Git)

### Permission denied

* Verify the service account has **explicit Read permissions** on the repository
* Check that the account is not disabled or expired
* Ensure the SSH key is added to the same account that has repository access

### SSH URL format issues

* Azure DevOps requires a specific SSH URL format: `git@ssh.dev.azure.com:v3/org/project/repo`
* Do not use HTTPS URLs - only SSH URLs are supported
* The `v3` in the path is required
* Organization, project, and repository names are case-sensitive

## Security Best Practices

1. **Use a dedicated service account** for the integration
2. **Grant Read permissions only** - write access is never needed
3. **Regularly audit access** - Review service account permissions periodically
4. **Enable IP restrictions** - Limit access to the Coalesce Quality egress IPs
5. **Monitor access logs** - Check for unexpected authentication attempts

## Additional Resources

* [Azure DevOps SSH Authentication](https://learn.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate)
* [Azure DevOps IP Address Restrictions](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/change-application-access-policies)
* [Azure DevOps Git Repository Permissions](https://learn.microsoft.com/en-us/azure/devops/repos/git/set-git-repository-permissions)
* [Back to Integration Overview](/code-integrations/overview)