Azure DevOps

Overview

The Azure DevOps integration brings Git pull request data, pipeline runs, and push events into Koalr — giving you DORA metrics, PR analytics, cycle time, flow metrics, and deploy risk scoring for teams using Azure Repos and Azure Pipelines.

Koalr ingests Azure DevOps data via service hook subscriptions. When a PR is created, updated, or completed; when commits are pushed; or when a pipeline build finishes, Azure DevOps sends a signed event to Koalr's webhook receiver. Koalr verifies the shared secret, resolves the organization, and enqueues the event for processing — typically within seconds.

What Koalr syncs

Data	Sync method	Frequency
Pull requests (open, merged)	Webhook	Real-time
PR reviews and approvals	Webhook	Real-time
Push events (commits)	Webhook	Real-time
Pipeline build results	Webhook	Real-time
Repository metadata	REST backfill	On connect

Backfill on connect: After service hooks are configured, Koalr triggers a one-time REST backfill of the last 90 days of PR and pipeline history so your dashboards populate immediately.

Connecting Azure DevOps

Prerequisites

• An Azure DevOps account with Project Administrator or Organization Administrator access (required to create service hooks).
• A Personal Access Token (PAT) with the following scopes:
  • Code: Read
  • Build: Read
  • Pull Request Threads: Read

Steps

1. In Koalr, go to Settings → Integrations.

2. Click Connect next to Azure DevOps.

3. Enter your Azure DevOps organization URL (e.g. https://dev.azure.com/my-org) and your Personal Access Token.

4. Koalr validates the PAT and saves the integration.

5. Copy the webhook URL and shared secret shown in the confirmation dialog.

6. In Azure DevOps, go to Project Settings → Service hooks.

7. Click + Create subscription.

8. Select Web Hooks as the service.

9. Configure a subscription for each of the following triggers, using the same webhook URL and shared secret for all of them:

   Trigger	Event type in Azure DevOps
   Pull request created	git.pullrequest.created
   Pull request updated	git.pullrequest.updated
   Pull request merge attempted	git.pullrequest.merged
   Code pushed	git.push
   Build completed	build.complete

10. In each subscription, set Basic authentication password to the shared secret from step 5 (leave the username empty).

11. Click Test and confirm Azure DevOps reports 200 OK, then click Finish.

Creating a Personal Access Token

1. In Azure DevOps, click your user avatar → Personal access tokens.
2. Click + New Token.
3. Give it a descriptive name (e.g. koalr-integration).
4. Set expiration as appropriate for your security policy.
5. Select Custom defined scope and check the permissions listed above.
6. Click Create and copy the token — it is shown only once.

Webhook security

Koalr verifies every inbound request using the shared secret you provided. Azure DevOps sends the secret as the Basic Auth password field. Koalr decodes the Authorization header and compares the password using SHA-256 HMAC with constant-time comparison to prevent timing oracle attacks. Requests with a missing or invalid secret are rejected and never enqueued.

Keep your shared secret confidential. If it is ever compromised, disconnect and reconnect the integration from Settings → Integrations → Azure DevOps to rotate to a new secret.

Pull request data mapped to Koalr metrics

Azure DevOps PR field	Koalr metric
creationDate	PR open time (cycle time start)
closedDate (when completed)	Merge time (cycle time end, DORA lead)
status: completed	Deployment frequency input
status: abandoned	PR closed (not counted in throughput)
sourceRefName	Head branch
targetRefName	Base branch
reviewers[].vote	Review approvals (10 = approved)
Build result: failed	Change failure rate

Vote values

Azure DevOps reviewer votes map to Koalr review states as follows:

Vote value	Azure DevOps meaning	Koalr state
10	Approved	APPROVED
5	Approved with suggestions	APPROVED
0	No vote	(ignored)
-5	Waiting for author	CHANGES_REQUESTED
-10	Rejected	CHANGES_REQUESTED

Feature availability

Feature	Azure DevOps	GitHub
PR analytics	Yes	Yes
DORA metrics (all 4)	Yes	Yes
Deploy risk scoring	Yes	Yes
Pipeline / CI status	Yes	Yes
Review queue	Yes	Yes
Flow metrics	Yes	Yes
Cycle time	Yes	Yes
CODEOWNERS sync	No	Yes
GitHub Copilot analytics	No	Yes
Deploy risk gate (PR block)	No	Yes

Troubleshooting

Events not appearing after service hook setup

In Azure DevOps, go to Project Settings → Service hooks and check the history for each subscription. A failed delivery shows the HTTP response code. Confirm Koalr returned 200 OK. If not, verify the webhook URL is correct and the shared secret matches.

"Unauthorized" on test delivery

The shared secret in Azure DevOps must exactly match the secret shown in Koalr's integration dialog. Azure DevOps sends it as the Basic Auth password with an empty username. Disconnect and reconnect to generate a fresh secret.

PRs or pipeline runs missing after backfill

Backfill covers the last 90 days. Data older than 90 days is not included. If data within that window is missing, verify the PAT has Code: Read and Build: Read scopes and has not expired.

PAT expiration

Azure DevOps PATs expire according to the policy you set when creating them. If sync stops working, check whether your PAT has expired. Go to Settings → Integrations → Azure DevOps and reconnect with a fresh PAT.

Multiple projects in one organization

Koalr's REST backfill fetches all Git repositories across all projects in the Azure DevOps organization. Service hook subscriptions, however, must be created per project. Repeat steps 6–11 for each project you want to monitor.