Install Pando

Azure DevOps

azuredevops Clone from Azure DevOps Services or Azure DevOps Server with a personal access token, Microsoft Entra ID or an SSH key, and pick repositories from a list.

Setup

  1. Choose how Pando signs in

    Settings method, host

  2. Create a personal access token

    1. In Azure DevOps, open User settings → Personal access tokens → New Token.
    2. Enter a Name, select the Organization, and set an Expiration. On Azure DevOps Server, select the collection.
    3. Under Scopes, choose Custom defined, then select Read under Code.
    4. Choose Create and copy the token.

    Settings token · Only when method is token

  3. Register an app in Microsoft Entra ID

    1. In the Microsoft Entra admin center, open Entra ID → App registrations → New registration.
    2. Enter a Name and choose Register.
    3. For Entra ID sign-in, under API permissions, choose Add a permission → Azure DevOps → Delegated permissions, select vso.code, and choose Add permissions.
    4. For Entra ID sign-in, under Authentication, set Allow public client flows to Yes and choose Save.
    5. For browser sign-in, under Authentication, choose Add Redirect URI → Web, enter your Pando address plus /api/v1/sources/callback, and choose Configure.
    6. For a service principal, in Azure DevOps open Organization settings → Users → Add users. Enter the app's name, choose Basic access and the projects, and choose Add.
    7. On the app's Overview, copy the Application (client) ID and Directory (tenant) ID.

    Open App registrations

    Settings client_id, tenant_id · Only when method is oauth or service_principal

  4. Create a client secret

    1. In the app registration, open Certificates & secrets → Client secrets → New client secret.
    2. Enter a description, choose an expiration, and choose Add.
    3. Copy the secret's Value.

    Settings client_secret · Only when method is oauth or service_principal

  5. Add an SSH key

    1. Run ssh-keygen -t rsa -b 3072 -f pando-azure -N "".
    2. In Azure DevOps, open User settings → SSH public keys → New Key.
    3. Paste pando-azure.pub into Public Key Data, enter a name, and choose Save.
    4. Paste pando-azure below.
    5. Run ssh-keyscan ssh.dev.azure.com, or your server's host, and paste its output below.

    Settings ssh_private_key, ssh_passphrase, known_hosts · Only when method is ssh

  6. Choose an organization

    Settings scope

Settings (12)
methodHow Pando signs inRequired
  • token Personal access token — A token with Code (Read) scope. Works with Azure DevOps Services and Server.
  • oauth Microsoft Entra ID sign-in — A person authorizes Pando with their work or school account, by device code or in the browser. Azure DevOps Services only.
  • service_principal Service principal — An app registration signs in with its client secret. It must be added to the organization. Azure DevOps Services only.
  • ssh SSH key — A key added to a user's SSH public keys. Repositories are entered by address.

one of the values above · Default token

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default dev.azure.com

scopeOrganization

The organization, or organization/project to limit the connection to one project. On Azure DevOps Server, the collection, or collection/project.

string · For example acme or acme/Payments

tokenPersonal access tokenCredential

A personal access token with the Code (Read) scope.

string · Used when method is token

tenant_idDirectory (tenant) ID

The app registration's directory (tenant) ID. Only a multitenant app accepts organizations.

string · Default organizations · Used when method is oauth or service_principal

client_idApplication (client) ID

The app registration's application (client) ID, from Microsoft Entra ID.

string · Used when method is oauth or service_principal

client_secretClient secretCredential

Required for a service principal and for browser sign-in. Device sign-in works without one.

string · Used when method is oauth or service_principal

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan ssh.dev.azure.com (or your server's host) prints it.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://dev.azure.com/{organization}, or https://HOST/{collection} on Azure DevOps Server

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates