This page covers on-prem (self-hosted) setup. You register your own Entra ID
(Azure AD) app so Azure DevOps OAuth runs against your tenant. For the hosted
SaaS integration, see Setup → Azure DevOps.
Create the OAuth app in the same Microsoft Entra ID tenant that your Azure
DevOps organization is connected to. An app registered in a different tenant
cannot authenticate against that Azure DevOps organization.
Register the Garth Assist app
Open the Azure portal
Sign in to the Azure portal and go to
Microsoft Entra ID → App registrations.
Create a new registration
Click New registration and fill in the details below.
Under Supported account types, select Accounts in any organizational
directory (Any Microsoft Entra ID tenant - Multitenant) to enable multi-tenant
support.Click Register.
| Field | Value |
|---|---|
| Name | Garth Assist |
| Supported account types | Accounts in any organizational directory (multitenant) |
| Redirect URI | https://<dns-host>/api/garth-assist/oauth/azuredevops/callback (platform: Web) |
Create a client secret
Open Certificates & secrets → Client secrets and click
New client secret. Set a description and expiry, then click Add.
Copy the secret Value immediately.
Add API permissions
Open API permissions → Add a permission and add the delegated permissions
below, then click Grant admin consent for your tenant.Azure DevOps
Microsoft Graph
| Permission | Description |
|---|---|
vso.build | Build (read) |
vso.code_status | Code (status) |
vso.code_write | Code (read and write) |
vso.profile | User profile (read) |
vso.project | Project and team (read) |
| Permission | Description |
|---|---|
email | View users’ email address |
offline_access | Maintain access to data you have given it access to |
openid | Sign users in |
profile | View users’ basic profile |
User.Read | Sign in and read user profile |
All permissions are Delegated. After granting admin consent, each
permission’s Status should show a green Granted for <tenant> check.
Environment variables
Record the following values for your on-prem deployment:| Environment variable | Value |
|---|---|
AZURE_DEVOPS_CLIENT_ID | The Application (client) ID from the app’s Overview page |
AZURE_DEVOPS_CLIENT_SECRET | The client secret value created in step 3 |