OpenHands Enterprise now works with Azure DevOps.

So now if you comment on a work item or a PR, and OpenHands picks it up, does the work, and opens a pull request in Azure Repos.

I know a lot of teams live in Azure DevOps and get skipped by tools that only speak GitHub. This is for you.

@OpenHandsDev Docs for @AzureDevOps
https://docs.openhands.dev/enterprise/integrations/azure-devops…

Azure DevOps - OpenHands Docs

Source: https://docs.openhands.dev/enterprise/integrations/azure-devops This guide explains how to connect Azure DevOps Services to an OpenHands Enterprise installation. The integration lets users sign in with Microsoft Entra ID, open Azure Repos, create branches and pull requests, and use Azure Boards work items or pull request comments as context for OpenHands workflows.

Prerequisites

• An OpenHands Enterprise installation using Replicated or standalone Helm.
• A Microsoft Entra administrator who can register an application and create a client secret.
• An Azure DevOps Services organization, project, and repository.
• Azure DevOps users with access to the projects and repositories they will use with OpenHands.
• Network access from OpenHands tologin\.microsoftonline\.comanddev\.azure\.com.
• If you plan to trigger automations from Azure DevOps Service Hooks, network access from Azure DevOps back to the OpenHands app URL or automation webhook URL.

Register a Microsoft Entra Application

In the Azure portal, create a Microsoft Entra app registration for OpenHands.

1. Go toMicrosoft Entra ID > App registrations.
2. ClickNew registration.
3. Enter a name such asOpenHands Azure DevOps.
4. Select the supported account type for your organization.
5. Add aWebredirect URI:https://auth.app.<your-openhands-domain>/realms/allhands/broker/azure_devops/endpoint Replace<your\-openhands\-domain\>with the domain for your OpenHands Enterprise installation. If you configured a custom authentication hostname, use that hostname instead ofauth\.app\.<your\-openhands\-domain\>.
6. ClickRegister.
7. Copy theDirectory (tenant) IDandApplication (client) ID.
8. Go toCertificates & secretsand create a client secret. Copy the secret value before leaving the page.
9. If your tenant requires explicit API permissions, add the Azure DevOps delegated permission required for user access and grant admin consent.

OpenHands requests the following Microsoft identity scopes during sign-in:

openid email profile offline_access https://app.vssps.visualstudio.com/.default

Configure Azure DevOps Access

Make sure the users who will sign in to OpenHands have access to the Azure DevOps organization, projects, and repositories they need. OpenHands uses the signed-in user’s Azure DevOps access token for repository discovery and Git operations.Repository names in OpenHands use this format:

organization/project/repository

For example:

Configure the Admin Console

Pick the path that matches how OpenHands Enterprise is deployed.

• Replicated
• Standalone Helm

Open the Replicated Admin Console for your OpenHands Enterprise installation and go to the application configuration page.InAzure DevOps Authentication:

1. EnableAzure DevOps Authentication.
2. Enter theMicrosoft Entra Tenant ID.
3. Enter theAzure DevOps Organizationif you want to set a default organization.
4. Enter theAzure DevOps Client ID.
5. Enter theAzure DevOps Client Secret.
6. Save and deploy the updated configuration.

Set Azure DevOps values on theopenhandsandopenhands\-secretscharts.In yourvalues\.yamlfor theopenhandschart:

azureDevOps:
  enabled: true
  tenantId: "<your-microsoft-entra-tenant-id>"
  organization: "<your-azure-devops-organization>"
  auth:
    existingSecret: azure-devops-app

In yourvalues\.yamlfor theopenhands\-secretschart:

config:
  azure_devops_client_id: "<your-azure-devops-client-id>"
  azure_devops_client_secret: "<your-azure-devops-client-secret>"

Then redeploy both charts. Deploying theopenhands\-secretschart with these values creates the Kubernetes secret namedazure\-devops\-app. Theopenhandschart reads the client ID and client secret from that secret viaazureDevOps\.auth\.existingSecret. If you use a different secret name, set the same name in both charts.

Sign In with Azure DevOps

After the deployment is completed, users chooseSign in with Azure DevOpson your app’s login page.On first sign-in, Microsoft may ask the user to consent to the requested permissions. After sign-in, OpenHands stores the user’s Azure DevOps token through the authentication provider so it can list repositories and run Git operations as that user.

Use Azure DevOps Repositories

After signing in, users can select Azure DevOps repositories from the OpenHands repository picker. OpenHands can:

• List Azure DevOps projects and repositories available to the signed-in user.
• Clone Azure Repos using the signed-in user’s OAuth token.
• Read branch and pull request context.
• Create branches and pull requests.
• Read and post Azure Repos pull request comments.
• Read and post Azure Boards work item comments.

OpenHands does not require users to paste a personal access token for Azure DevOps repository access when Microsoft Entra sign-in is configured.

Trigger OpenHands from Azure DevOps

Azure DevOps events can be connected to OpenHands automations through Azure DevOps Service Hooks and OpenHands custom webhooks. Use this pattern for workflows such as:

• A work item comment that asks OpenHands to create an implementation pull request.
• A pull request comment that asks OpenHands to review the change.
• A pull request comment that asks OpenHands to generate tests or validation evidence.
• A pipeline or incident event that asks OpenHands to inspect logs and propose a fix.

To configure this pattern:

1. Register a custom webhook in OpenHands. SeeEvent-Based Automations.
2. Create an Azure DevOps Service Hook that sends the selected event to the webhook URL.
3. Create an OpenHands automation that filters for the event type, repository, project, or trigger phrase you want to support.
4. Test with a non-production repository or project before enabling the automation broadly.

Troubleshooting

SymptomCheckThe Azure DevOps login option is not visibleConfirmAzure DevOps Authenticationis enabled in the Admin Console or Helm values and the deployment has been applied.OAuth redirects failConfirm the Entra redirect URI exactly matcheshttps://auth\.app\.<your\-openhands\-domain\>/realms/allhands/broker/azure\_devops/endpoint.Microsoft sign-in shows an invalid client or secret errorConfirm the Azure DevOps Client ID and Client Secret match the Microsoft Entra app registration. If the secret expired, create a new one and redeploy.Microsoft sign-in succeeds but no repositories are listedConfirm the user has access to the Azure DevOps organization, project, and repositories. Also confirm the default organization value is the organization name only.Consent fails or Azure DevOps API calls are deniedConfirm the Entra application has the required Azure DevOps delegated permission and that admin consent has been granted if your tenant requires it.Repository selection or Git operations failConfirm OpenHands can reachdev\.azure\.comand that the repository is referenced asorganization/project/repository.Azure DevOps Service Hook deliveries do not trigger an automationConfirm the custom webhook is registered, the Service Hook URL is correct, the event type matches the automation, and the automation is enabled.