Manage Azure DevOps work items, pipelines, and repos from Guild agents

Integrations · Azure DevOps

Guild agents read, create, and update Azure DevOps resources using OAuth 2.0 credentials stored and injected server-side by Guild. Credential policies let you allow or deny specific operations before any request leaves Guild. Every call is recorded in Guild’s audit trail so teams can see exactly what each agent did.

Book a demo

See how teams govern agents that use Azure DevOps.

Start free

Connect Azure DevOps and scope your first agent.

What the Azure DevOps integration exposes

The tools cover work items, repositories, pull requests, pipelines, builds, approvals, environments, deployment groups, agent pools, check configurations, variable groups, and Git refs. Tools follow the naming pattern azure_devops_{resource}_{action}, for example azure_devops_work_items_create or azure_devops_builds_queue. Agents can read commit history, retrieve build logs, queue new builds, update approvals, and manage pipeline definitions. Because agents perform better with fewer tools, you can use pick() to include only the tools a given agent needs.

How it works

Open Credentials in Guild

Go to Credentials in Guild. The page lists services you can connect.

Authorize through Microsoft

Click Azure DevOps and complete the authorization through your Microsoft account. Guild stores the OAuth token server-side; your agent code never sees it.

Import tools into your agent

Import azureDevOpsTools from the package and spread it into your agent’s tools object. Use pick() to select only the tools your agent needs.

Why Azure DevOps access needs governing

An agent with broad access could queue builds, update approvals, delete repositories, or modify variable groups. Guild’s credential policies let you write ALLOW and DENY rules that the credential proxy enforces before any request reaches Azure DevOps. Rules can target specific operations by name or glob pattern, scope access to particular agents or workspaces, and restrict HTTP methods so a credential grants only read access. Tokens are stored and injected by Guild’s credential proxy; agent code, prompts, and containers never receive them. You can scope a credential to a single workspace, a single member, or one installed agent, so different agents use different identities. Scoped rules on the same credential let one agent list work items while another is allowed to update approvals. Teams that need tighter boundaries can turn on workspace-level isolation so agents in that workspace never fall back to the organization’s shared credential.

About the Azure DevOps integration

The @guildai-services/guildai~azure-devops package provides agents with access to the Azure DevOps REST API through Guild’s OAuth 2.0 integration. This integration is generally available for all production users.

Authentication

Type: OAuth 2.0 (Microsoft identity platform)
Token expiration: 1 hour (auto-refreshed)

Setup

Open Credentials

Go to Credentials in Guild.

Connect Azure DevOps

Click Azure DevOps and authorize through your Microsoft account.

Grant access

Authorize access to your Azure DevOps organization.

Usage

import { azureDevOpsTools } from "@guildai-services/guildai~azure-devops"
import { llmAgent } from "@guildai/agents-sdk"

export default llmAgent({
  description: "An agent that manages Azure DevOps work items",
  tools: { ...azureDevOpsTools },
})

Selecting specific tools

Agents perform better with fewer tools. Use pick() to include only what your agent needs. Tools are named with the azure_devops_ prefix — for example, work_items_list becomes azure_devops_work_items_list.

import { azureDevOpsTools } from "@guildai-services/guildai~azure-devops"
import { llmAgent, pick } from "@guildai/agents-sdk"

export default llmAgent({
  description: "An agent that manages Azure DevOps work items",
  tools: {
    ...pick(azureDevOpsTools, [
      "azure_devops_work_items_list",
      "azure_devops_work_items_get_work_item",
      "azure_devops_work_items_create",
      "azure_devops_work_items_update",
    ]),
  },
})

Tools

Tools in the latest published version of guildai~azure-devops:

All 120 tools

Tool	What it does
`azure_devops_agents_add`	Adds an agent to a pool.
`azure_devops_agents_delete`	Delete an agent.
`azure_devops_agents_get_pool_permission`	Get Permissions on Pool.
`azure_devops_agents_list`	Get a list of agents.
`azure_devops_agents_replace_agent`	Replace an agent.
`azure_devops_agents_update`	Update agent details.
`azure_devops_approvals_get`	Get an approval.
`azure_devops_approvals_query`	List Approvals.
`azure_devops_approvals_update`	Update approvals.
`azure_devops_artifacts_create`	Associates an artifact with a build.
`azure_devops_artifacts_get`	Get a specific artifact from a pipeline run
`azure_devops_artifacts_list`	Gets all artifacts for a build.
`azure_devops_attachments_get`	Downloads an attachment.
`azure_devops_builds_delete`	Deletes a build.
`azure_devops_builds_get`	Gets a build
`azure_devops_builds_get_build_changes`	Gets the changes associated with a build
`azure_devops_builds_get_build_log`	Gets an individual log file for a build.
`azure_devops_builds_get_build_logs`	Gets the logs for a build.
`azure_devops_builds_list`	Gets a list of builds.
`azure_devops_builds_queue`	Queues a build
`azure_devops_builds_update_build`	Updates a build.
`azure_devops_builds_update_builds`	Updates multiple builds.
`azure_devops_check_configurations_add`	Add a check configuration
`azure_devops_check_configurations_delete`	Delete check configuration by id
`azure_devops_check_configurations_get`	Get Check configuration by Id
`azure_devops_check_configurations_list`	Get Check configuration by resource type and id
`azure_devops_check_configurations_query`	Get check configurations for multiple resources by resource type and id.
`azure_devops_check_configurations_update`	Update check configuration
`azure_devops_check_evaluations_evaluate`	Initiate an evaluation for a check in a pipeline
`azure_devops_check_evaluations_get`	Get details for a specific check evaluation
`azure_devops_commits_get`	Retrieve a particular commit.
`azure_devops_commits_get_changes`	Retrieve changes for a particular commit.
`azure_devops_commits_get_commits_batch`	Retrieve git commits for a project matching the search criteria
`azure_devops_commits_get_push_commits`	Retrieve a list of commits associated with a particular push.
`azure_devops_definitions_create`	Creates a new definition.
`azure_devops_definitions_delete`	Deletes a definition and all associated builds.
`azure_devops_definitions_get`	Gets a definition, optionally at a specific revision.
`azure_devops_definitions_list`	Gets a list of definitions.
`azure_devops_definitions_restore_definition`	Restores a deleted definition
`azure_devops_definitions_update`	Updates an existing build definition.
`azure_devops_deploymentgroups_add`	Create a deployment group.
`azure_devops_deploymentgroups_delete`	Delete a deployment group.
`azure_devops_deploymentgroups_get`	Get a deployment group by its ID.
`azure_devops_deploymentgroups_list`	Get a list of deployment groups by name or IDs.
`azure_devops_deploymentgroups_update`	Update a deployment group.
`azure_devops_environmentdeploymentrecords_list`	Get environment deployment execution history
`azure_devops_environments_add`	Create an environment.
`azure_devops_environments_delete`	Delete the specified environment.
`azure_devops_environments_get`	Get an environment by its ID.
`azure_devops_environments_list`	Get all environments.
`azure_devops_environments_update`	Update the specified environment.
`azure_devops_fields_create`	Create a new field.
`azure_devops_fields_delete`	Deletes the field.
`azure_devops_fields_get`	Gets information on a specific field.
`azure_devops_fields_list`	Returns information for all fields.
`azure_devops_fields_update`	Update a field.
`azure_devops_items_get_items_batch`	Retrieves a batch of items in a repo / project for a given list of paths or a long path
`azure_devops_items_list`	Get Item Metadata and/or Content for a collection of items.
`azure_devops_logs_get`	Get a specific log from a pipeline run
`azure_devops_logs_list`	Get a list of logs from a pipeline run.
`azure_devops_pipelines_create`	Create a pipeline.
`azure_devops_pipelines_get`	Gets a pipeline, optionally at the specified version
`azure_devops_pipelines_list`	Get a list of pipelines.
`azure_devops_policy_configurations_get`	Retrieve a list of policy configurations by a given set of scope/filtering criteria.
`azure_devops_pools_add`	Create an agent pool.
`azure_devops_pools_delete`	Delete an agent pool.
`azure_devops_pools_get`	Get information about an agent pool.
`azure_devops_pools_get_agent_pools_by_ids`	Get a list of agent pools.
`azure_devops_pools_update`	Update properties on an agent pool
`azure_devops_pull_requests_create`	Create a pull request.
`azure_devops_pull_requests_get_pull_request`	Retrieve a pull request.
`azure_devops_pull_requests_get_pull_request_by_id`	Retrieve a pull request.
`azure_devops_pull_requests_get_pull_requests`	Retrieve all pull requests matching a specified criteria.
`azure_devops_pull_requests_get_pull_requests_by_project`	Retrieve all pull requests matching a specified criteria.
`azure_devops_pull_request_statuses_create`	Create a pull request status.
`azure_devops_pull_request_statuses_delete`	Delete pull request status.
`azure_devops_pull_request_statuses_get`	Get the specific pull request status by ID.
`azure_devops_pull_request_statuses_list`	Get all the statuses associated with a pull request.
`azure_devops_pull_request_statuses_update`	Update pull request statuses collection.
`azure_devops_pull_requests_update`	Update a pull request
`azure_devops_queries_create`	Creates a query, or moves a query.
`azure_devops_queries_delete`	Delete a query or a folder.
`azure_devops_queries_get`	Retrieves an individual query and its children
`azure_devops_queries_list`	Gets the root queries and their children
`azure_devops_queries_update`	Update a query or a folder.
`azure_devops_refs_list`	Queries the provided repository for its refs and returns them.
`azure_devops_refs_update_ref`	Lock or Unlock a branch.
`azure_devops_refs_update_refs`	Creating, updating, or deleting refs(branches).
`azure_devops_repositories_create`	Create a git repository in a team project.
`azure_devops_repositories_delete`	Delete a git repository
`azure_devops_repositories_get_repository`	Retrieve a git repository.
`azure_devops_repositories_list`	Retrieve git repositories.
`azure_devops_repositories_update`	Updates the Git repository with either a new repo name or a new default branch.
`azure_devops_runs_get`	Gets a run for a particular pipeline.
`azure_devops_runs_list`	Gets top 10000 runs for a particular pipeline.
`azure_devops_runs_run_pipeline`	Runs a pipeline.
`azure_devops_stages_update`	Update a build stage
`azure_devops_stats_list`	Retrieve statistics about all branches within a repository.
`azure_devops_statuses_create`	Create Git commit status.
`azure_devops_statuses_list`	Get statuses associated with the Git commit.
`azure_devops_targets_delete`	Delete a deployment target in a deployment group.
`azure_devops_targets_get`	Get a deployment target by its ID in a deployment group
`azure_devops_targets_list`	Get a list of deployment targets in a deployment group.
`azure_devops_targets_update`	Update tags of a list of deployment targets in a deployment group.
`azure_devops_timeline_get`	Gets details for a build
`azure_devops_variablegroups_add`	Add a variable group.
`azure_devops_variablegroups_delete`	Delete a variable group
`azure_devops_variablegroups_get`	Get a variable group.
`azure_devops_variablegroups_get_variable_groups_by_id`	Get variable groups by ids.
`azure_devops_variablegroups_share_variable_group`	Add a variable group.
`azure_devops_variablegroups_update`	Update a variable group.
`azure_devops_work_items_create`	Creates a single work item.
`azure_devops_work_items_delete`	Deletes the specified work item and sends it to the Recycle Bin, so that it can be restored back, if required.
`azure_devops_work_items_get_work_item`	Returns a single work item.
`azure_devops_work_items_get_work_items_batch`	Gets work items for a list of work item ids (Maximum 200)
`azure_devops_work_items_get_work_item_template`	Returns a single work item from a template.
`azure_devops_work_items_list`	Returns a list of work items (Maximum 200)
`azure_devops_work_items_update`	Updates a single work item.
`azure_devops_work_item_types_get`	Returns a work item type definition.
`azure_devops_work_item_types_list`	Returns the list of work item types

Webhook events

Azure DevOps does not support webhook triggers in Guild. This integration is API-access only.

Limitations

No webhook or trigger support
API access requires the user’s Azure DevOps organization to be accessible via the authorized Microsoft account

Frequently asked questions

Can Guild trigger an agent when a pull request is opened in Azure DevOps?

No. Azure DevOps does not support webhook triggers in Guild. This integration is API-access only, so agents must poll for changes using tools such as azure_devops_pull_requests_get_pull_requests rather than reacting to events.

How do I stop an agent from deleting repositories or builds?

Write a DENY rule in the credential policy targeting operations such as azure_devops_repositories_delete and azure_devops_builds_delete. Guild’s credential proxy enforces the rule before the request reaches Azure DevOps, and a matching DENY always overrides any ALLOW rule. See credential policies for syntax.

Does the agent ever see the OAuth token?

No. Guild stores the token server-side and injects it through the credential proxy only after the policy check passes. The token never enters the agent’s code, container, prompt, or state.

Can one Azure DevOps credential serve some agents but not others?

Yes. You can scope a credential to a single workspace, a single member, or one installed agent from the Credentials page. Credential policy rules can further restrict which operations each agent may call on the same shared credential, using the agents field in the rule.

Put a governed agent on Azure DevOps this week

Book a demo

See how teams govern agents that use Azure DevOps.

Start free

Connect Azure DevOps and scope your first agent.

Also runs on Guild: Bitbucket · GitHub · Google Compute · Linear Read: Docs: Credential policies · Credentials · Tools in agents

Overview

Models

Inference providers

Code & CI/CD

Communication

Project management

Testing

Productivity

Monitoring & observability

Data

Customer support

Sales & finance

Recruiting

Manage Azure DevOps work items, pipelines, and repos from Guild agents

Book a demo

Start free

What the Azure DevOps integration exposes

How it works

Why Azure DevOps access needs governing

About the Azure DevOps integration

Authentication

Setup

Usage

Selecting specific tools

Tools

Webhook events

Limitations

Frequently asked questions

Put a governed agent on Azure DevOps this week

Book a demo

Start free

Book a demo

Start free

​What the Azure DevOps integration exposes

​How it works

​Why Azure DevOps access needs governing

​About the Azure DevOps integration

​Authentication

​Setup

​Usage

​Selecting specific tools

​Tools

​Webhook events

​Limitations

​Frequently asked questions

​Put a governed agent on Azure DevOps this week

Book a demo

Start free

​Related

What the Azure DevOps integration exposes

How it works

Why Azure DevOps access needs governing

About the Azure DevOps integration

Authentication

Setup

Usage

Selecting specific tools

Tools

Webhook events

Limitations

Frequently asked questions

Put a governed agent on Azure DevOps this week

Related