Azure DevOps modules

Expand to view access requirements for the functionality in this article.

table 0-row-2 1-row-2 2-row-2 3-row-2 layout-auto html-authored no-header
Adobe Workfront package	Any Adobe Workfront Workflow package and any Adobe Workfront Automation and Integration package Workfront Ultimate Workfront Prime and Select packages, with an additional purchase of Workfront Fusion.
Adobe Workfront licenses	Standard Work or higher
Adobe Workfront Fusion license	Operation-based: Available to organizations with operation-based licenses Connector-based (legacy): Workfront Fusion for Work Automation and Integration
Product	If your organization has a Select or Prime Workfront package that does not include Workfront Automation and Integration, your organization must purchase Adobe Workfront Fusion.

For more detail about the information in this table, see Access requirements in documentation.

For information on Adobe Workfront Fusion licenses, see Adobe Workfront Fusion licenses.

Expand to view instructions for connecting Azure DevOps to Adobe Workfront Fusion using a federated connection.

note
NOTE
Setting up this connection requires two visits to the Microsoft Entra admin center. You register the app first, then create the connection in Workfront Fusion, the return to Microsoft Entra ID to add the federated credential. This is because the federated credential identified one specific connection, and that identifier does not exist until the connection is created. The same limits apply to this connection as the service principal connection. A small number of admin-level actions, such as managing user licenses, still require a personal account connection.

• Prerequisites to connecting Azure DevOps to Workfront Fusion using a federated connection
• Create the app registration in Microsoft Entra ID (Federated connection)
• Collect your connection details (Federated connection)
• Create the connection in Workfront Fusion (Federated connection)
• Add the federated credential in Microsoft Entra ID
• Verify the connection (Federated connection)

Prerequisites to connecting Azure DevOps to Workfront Fusion using a federated connection

To create this connection, you need the following:

• Global Administrator or Application Administrator access in Microsoft Entra ID, to register the app and add the federated credential. If you do not have this access, ask someone on your IT or identity team to complete those steps for you.
• Project Collection Administrator access in your Azure DevOps organization, to add the service principal as a member. This is often a different person than the person that manages Microsoft Entra ID.
• The name of your Azure DevOps organization. You can find this in your Azure DevOps URL: dev.azure.com/<your organization name>.

Create the app registration in Microsoft Entra ID (Federated connection)

1. Sign in to the Microsoft Entra admin center.
2. Go to App registrations > New registration.
3. Give the app a clear, recognizable name. For example, Workfront Fusion Azure DevOps Integration.
4. Leave Redirect URI blank. This connection does not involve signing in through a browser.
5. Select Register.
6. Do not create a client secret. A federated connection does not use one.
7. Continue to Collect your connection details.

Collect your connection details (Federated connection)

1. From the app registration’s Overview page, note the following values. You enter these when creating the connection in the module.

   table 0-row-2 1-row-2 2-row-2 layout-auto html-authored no-header
   Tenant ID	On the Overview page, labeled Directory (tenant) ID.
   Client ID	On the Overview page, labeled Application (client) ID.
   Organization	Your Azure DevOps organization name. For example, if your URL is dev.azure.com/yourorg, enter yourorg.

2. Continue to Create the connection in Workfront Fusion.

note
NOTE
As with the service principal connection, you can skip the app registration’s API permissions area. Access toAzure DevOps is granted inside Azure DevOps, in the next procedure.

Create the connection in Workfront Fusion (Federated connection)

1. In the module’s connection setup screen, select the federated connection type.

2. Enter the following:

   • Tenant ID
   • Client ID
   • Organization

3. Select Create.

   Workfront Fusion displays three values. Leave this page open, because you will need these values later in the process of creating the connection.

   table 0-row-2 1-row-2 2-row-2 layout-auto html-authored no-header
   Issuer	https://oidc.automations.adobe.com.
   Subject	This identifies this connection. It looks like fusion:6e5b1c2a345bd8d1ed98b6b4f1459818:28964. It is different for every connection you create.
   Audience	api://AzureADTokenExchange.

   note important
   IMPORTANT
   Do not close the panel or select Cancel. The connection is not finished until you complete the rest of the procedure. If you close the panel, you must delete the connection and start again, because a new connection receives a new Subject.

4. Copy the Subject value.

5. Continue to Add the federated credential in Microsoft Entra ID.

Add the federated credential in Microsoft Entra ID

This procedure is what replaces the client secret. It tells Microsoft Entra ID to accept tokens that Workfront Fusion issues for this one connection.

1. In a new browser tab, return to the Microsoft Entra admin center and open your app registration.

2. Go to Certificates & secrets > Federated credentials.

3. Select Add credential.

4. In Federated credential scenario, select Other issuer.

5. Enter the following:

   table 0-row-2 1-row-2 2-row-2 3-row-2 layout-auto html-authored no-header
   Issuer	https://oidc.automations.adobe.com
   Subject identifier	The Subject you copied from Workfront Fusion. Paste it exactly, with no added spaces.
   Name	A name that identifies this connection, so you can find it later. For example, workfront-fusion-connection-28964.
   Audience	api://AzureADTokenExchange. This is usually filled in for you. Leave the default value.

6. Click Add.

7. Continue to Verify the connection.

note
NOTE
Microsoft Entra ID allows a maximum of 20 federated credentials on a single app registration, and the Subject identifier must match exactly. Wildcards are not supported. Because each Workfront Fusion connection has its own Subject, each connection needs its own federated credential. If you expect more than 20 connections, register more than one app and spread the connections across them.

Verify the connection (Federated connection)

1. Return to the Workfront Fusion browser tab, where the connection panel is still open.

2. Click Save.

   • If everything is set up correctly, the connection validates successfully, and you can proceed with configuring the module.
   • If verification fails, the panel stays open and displays the error. Correct the problem in Microsoft Entra ID or Azure DevOps and select Save again. You do not need to recreate the connection, and the Subject does not change.

note
NOTE
A federated credential that you add in Microsoft Entra ID can take a short time to become active. If verification fails immediately after you add the credential, wait a minute and select Save again before investigating further.

Troubleshooting

table 0-row-2 1-row-2 2-row-2 layout-auto html-authored no-header
The connection fails verification with an invalid client or invalid request error	Microsoft Entra ID could not match the token to a federated credential. Check that the Issuer is exactly https://oidc.automations.adobe.com with no trailing slash, and that the Subject identifier is character-for-character identical to the Subject shown in Workfront Fusion. A Subject copied from a different connection is the most common cause.
The connection verifies, but modules return 401 or 403 from Azure DevOps	The identity is trusted, but it has no access to your Azure DevOps data. Confirm you completed Add the service principal to your Azure DevOps organization, and that the service principal is assigned to the specific project the module uses.
You cannot add another federated credential	You have reached the limit of 20 federated credentials for that app registration. Register an additional app and create further connections against it.

Expand to view instructions for connecting Azure DevOps to Workfront Fusion using EntraApp

1. Add an Azure DevOps module to your scenario.

2. Click Add next to the Connection field.

3. In the Connection Type field, select the type of connection that you want to use.

   note
   NOTE
   The Azure DevOps (EntraApp) allows you to request all scopes for the connection.

4. Fill out the following fields:

   table 0-row-2 1-row-2 2-row-2 3-row-2 4-row-2 layout-auto html-authored no-header
   Connection name	Enter a name for the connection that you are creating.
   Organization	Enter the name of the organization under which you created your Azure DevOps application.
   App ID	Enter the ID of the DevOps application that you are connecting to.
   Client Secret	Enter the client secret for the DevOps applications that you are connecting to.
   Request All Scopes	If you are using the Azure DevOps (EntraApp) connection type, enable this option to request all scopes for the connection.

5. To enter an Azure DevOps App ID or Client Secret, click Show advanced settings and enter them in the fields that open.

6. Click Continue to finish setting up the connection and continue creating your scenario.

Expand to view instructions for connecting Azure DevOps to Adobe Workfront Fusion using a service principal.

note
NOTE
Service principal authentication does not support every Azure DevOps feature. A small number of admin-level actions, such as managing user licenses, still require a personal account connection. Use service principal authentication if you only need this for work items, boards, repos, or pipelines.

• Prerequisites to connecting Azure DevOps to Workfront Fusion using a service principal
• Create the app registration in Microsoft Entra ID
• Create a client secret
• Collect your connection details
• Add the service principal to your Azure DevOps organization
• Create the connection

Prerequisites to connecting Azure DevOps to Workfront Fusion using a service principal

To create this connection, you need the following:

• Global Administrator or Application Administrator access in Microsoft Entra ID, to register the app. If you do not have this access, ask someone on your IT or identity team to complete that step for you.
• Project Collection Administrator access in your Azure DevOps organization, to add the service principal as a member. This is often a different person than the person that manages Microsoft Entra ID.
• The name of your Azure DevOps organization. You can find this in your Azure DevOps URL: dev.azure.com/<your organization name>.

Create the app registration in Microsoft Entra ID (Service principal)

1. Sign in to the Microsoft Entra admin center.
2. Go to App registrations > New registration.
3. Give the app a clear, recognizable name. For example, Workfront Fusion Azure DevOps Integration.
4. Leave Redirect URI blank. This connection does not involve signing in through a browser.
5. Select Register.
6. Continue to Create a client secret.

Create a client secret

1. In your new app registration, go to Certificates & secrets.
2. Select New client secret, add a description, and choose an expiry period.
3. Select Add.
4. Copy the secret’s Value immediately. It is displayed only once. If you navigate away before copying it, you must create a new one.
5. Continue to Collect your connection details.

Collect your connection details (Service principal)

1. From the app registration’s Overview page, note the following values. You enter these when creating the connection in the module.

   table 0-row-2 1-row-2 2-row-2 3-row-2 layout-auto html-authored no-header
   Tenant ID	On the Overview page, labeled Directory (tenant) ID.
   Client ID	On the Overview page, labeled Application (client) ID.
   Client Secret	The value you copied in Create a client secret.
   Organization	Your Azure DevOps organization name. For example, if your URL is dev.azure.com/yourorg, enter yourorg.

   note
   NOTE
   You can skip the app registration’s API permissions area. If you add Azure DevOps there, only Delegated permissions are available. Application permissions appear greyed out. This is expected, because Azure DevOps does not support granting access this way. Instead, access is granted directly inside Azure DevOps, in the next part.

2. Continue to Add the service principal to your Azure DevOps organization.

Add the service principal to your Azure DevOps organization

Registering the app in Microsoft Entra ID only creates its identity. It does not yet give the app any access to your Azure DevOps data. This procedure grants that access.

1. Sign in to your Azure DevOps organization, at dev.azure.com/<your organization name>.

2. Select Organization settings in the lower left, then select Users.

3. Select Add users.

4. In the search box, search by the app’s display name, which is the name you gave it when you registered the app. Do not search by the Client ID.

5. Select an access level:

   • Basic is usually enough for reading and writing work items, boards, and repos.
   • If your workflow needs to browse available processes, such as Agile, Scrum, or custom templates, as part of setup, add the service principal to the Project Collection Administrators group instead. This is a broader level of access, so only grant it if you need that capability.

6. Assign the service principal to the specific project or projects it needs, following your organization’s usual access practices.

7. Select Add.

8. Continue to Create the connection in Workfront Fusion.

Create the connection in Workfront Fusion (Service principal)

1. In the module’s connection setup screen, select the Service Principal connection type.

2. Enter the following:

   • Tenant ID
   • Client ID
   • Client Secret
   • Organization

3. Save the connection.

   If everything is set up correctly, the connection validates successfully.