> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/code-scanning/connect-your-source-code/code-scanning-for-azure-devops-with-entra-service-principal.md).

# Code Scanning for Azure DevOps with an Entra Service Principal

Let Aikido scan your Azure DevOps organization as a Microsoft Entra service principal instead of a personal access token.

## Code Scanning for Azure DevOps with an Entra Service Principal

Instead of a personal access token (PAT), you can let Aikido scan your Azure DevOps organization as a Microsoft Entra service principal that you own. No token or secret is created or stored: for every scan, Aikido proves its identity to Microsoft Entra, which issues a short-lived access token for your service principal. Nothing expires and nothing needs rotating.

{% hint style="info" %}
Your workspace must already be connected to Azure DevOps Services (dev.azure.com) with a PAT, and your Azure DevOps organization must be connected to a Microsoft Entra tenant (**Organization settings** → **Microsoft Entra**). You need to be able to register applications in that tenant and to add users to your Azure DevOps organization. Azure DevOps Server, the Aikido broker, and the local scanner keep using a PAT.
{% endhint %}

**First**, go to [General Settings](https://app.aikido.dev/settings/account), click **Update Personal Access Token** and, on the **Code Scanning** tab, click **Use An Entra Service Principal Instead**.

![Code Scanning tab in Aikido with the personal access token card and the button to use an Entra service principal instead](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-7bcc90c8a90c0bcf7f8e598cf87b6113228eb9e2%2Fazure-devops-scanning-use-entra-service-principal.png?alt=media)

You end up on the service principal management page, which can also be found at [Manage Azure DevOps Scanning service principal](https://app.aikido.dev/settings/integrations/azure-devops/scanning/service-principal). Keep this page open: it shows the **Issuer**, **Subject identifier**, and **Audience** you need in the next section.

![Aikido page for the scanning service principal showing the issuer, subject identifier, and audience values](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-e205802a30b3fbb198e0037b0db0217c92394b02%2Fazure-devops-scanning-service-principal-page.png?alt=media)

{% hint style="info" %}
Create a separate application for code scanning, even if you already set up [AutoFix with an Entra service principal](/autofix-and-remediation/configure/autofix-for-azure-devops-with-entra-service-principal.md). The Issuer and Audience are the same, but the Subject identifier is different because scanning uses its own Aikido identity, and the AutoFix application has write access to your projects.
{% endhint %}

**Next**, follow the instructions below to create the service principal in Microsoft Entra and give it read access in Azure DevOps.

### Register the application in Microsoft Entra

1. Open the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** → **App registrations** and click **New registration**.
2. Give the application a name, for example **Aikido Code Scanning**, keep **Single tenant only** selected, leave the redirect URI empty and click **Register**.

![Register an application form in Microsoft Entra with the name Aikido Code Scanning and single tenant selected](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-7a0f6aaf80f7495b5db186461237bc43e26d0bcc%2Fazure-devops-scanning-entra-register-app.png?alt=media)

1. On the **Overview** page of the application, copy the **Application (client) ID** and the **Directory (tenant) ID**. You insert both in Aikido later.
2. Go to **Certificates & secrets** → **Federated credentials** and click **Add credential**.

![Federated credentials tab of the Entra application with the Add credential button](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-db8bdc7e80039ef84ea1a380374f6afe1f64f3ee%2Fazure-devops-scanning-entra-federated-credentials.png?alt=media)

1. Select **Other issuer** and fill in the values exactly as shown on the service principal management page in Aikido:

* **Issuer**: the Issuer shown in Aikido
* **Type**: Explicit subject identifier
* **Value**: the Subject identifier shown in Aikido
* **Audience**: click **Edit** and replace the default with the Audience shown in Aikido. It contains your workspace id, so only tokens Aikido mints for your workspace are accepted. Give the credential a name, for example **aikido-code-scanning**, and click **Add**. You don't need a client secret or certificate.

![Add a credential form in Microsoft Entra filled in with the issuer, subject identifier, and audience from Aikido](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-2271973534f45ba6b63820129a0dca6e3c2b1c8d%2Fazure-devops-scanning-entra-add-credential.png?alt=media)

### Grant read access in Azure DevOps

1. In Azure DevOps, go to **Organization settings** → **Users** and click **Add users**.
2. Search for the application name (**Aikido Code Scanning**), set the **Access level** to **Basic**, and add it to the projects Aikido should scan. If the application doesn't show up yet, wait a minute and search again.
3. Under **Azure DevOps Groups**, select **Project Readers**. Then click **Add**.

![Add new users panel in Azure DevOps with the service principal, Basic access level, a project, and the Project Readers group selected](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-ddaa25b0d9781b16a8c22ba7dc948a0a9e170de9%2Fazure-devops-scanning-add-service-principal-as-reader.png?alt=media)

{% hint style="warning" %}
The default group is **Project Contributors**, which grants write access. Select **Project Readers** so the service principal can only read your code.
{% endhint %}

### Connect in Aikido

1. Go back to the service principal management page in Aikido.
2. Insert the **Directory (tenant) ID** and the **Application (client) ID** you copied earlier and click **Save Service Principal**. Aikido requests a token from Microsoft Entra and verifies that it can access the repositories of your Azure DevOps organization before saving.

You are all set. Scanning now authenticates as the service principal, and the **Code Scanning** tab shows which application is in use.

![Code Scanning tab in Aikido showing the configured Entra service principal with Manage and Remove buttons](https://3149773201-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyKbzcQGrx7UtrG0nPZZ7%2Fuploads%2Fgit-blob-88955567cc54039a79bf8856617bb04dbfbfd831%2Fazure-devops-scanning-service-principal-saved.png?alt=media)

{% hint style="info" %}
Your PAT stays stored but is no longer used. To switch back, click **Remove** on the **Code Scanning** tab: scanning then uses the stored PAT again, so update it first if it has expired. Deleting the federated credential in Microsoft Entra or removing the service principal from your Azure DevOps organization revokes the service principal only.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.aikido.dev/code-scanning/connect-your-source-code/code-scanning-for-azure-devops-with-entra-service-principal.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.