Skip to main content
Connect Odin to Azure DevOps to give Mjolnir access to your Azure Repos. Mjolnir reads your source code to map routes, authentication flows, and business logic for whitebox pentesting, and — when you enable PR Reviews — posts review feedback directly on your pull requests.
Odin reads your repository contents for pentesting. For PR Reviews it also posts review comments and a single status check on the pull requests you enable. It never pushes code, creates or merges pull requests, or changes your branches.

​
Two ways to connect

Odin supports two authentication models for Azure DevOps. Pick the one that fits your security requirements — both end up giving Mjolnir access to the same repositories.

​
Delegated (Entra OAuth)

Azure DevOps authenticates through Microsoft Entra ID, the supported successor to the old Azure DevOps OAuth apps. Borg runs a single multi-tenant app, and you consent to it inside your own tenant during the connect flow.
1

Open Integrations

Go to Management > Integrations in the sidebar.
2

Connect Azure DevOps

Click Connect next to Azure DevOps and choose Delegated OAuth. You’re sent to Microsoft to sign in and consent to the Odin app for your tenant.
3

Choose what to scan

Back in Odin, pick the organisation, then the project, then the repository you want Mjolnir to use.
You can revoke the connection at any time from your tenant’s enterprise-application settings.

​
Service principal (workload identity federation)

Authenticate with a service principal you own in your own Entra tenant, authenticated through workload identity federation. Borg never receives or stores a client secret or certificate — instead, our GCP-hosted backend presents a short-lived, Google-signed OIDC token that your service principal’s federated credential trusts. This gives you a dedicated non-human identity, least-privilege access, and revocation entirely under your control.
1

Start the service-principal setup

Under Management > Integrations, click Connect next to Azure DevOps and choose Service principal. Enter your Tenant ID, the Client (application) ID of your service principal, and your Azure DevOps organisation, then save.
2

Configure the federated credential

Odin shows you three values — an Issuer, a Subject identifier, and an Audience. In your Entra tenant, add a federated credential to your service principal (app registration) using exactly those values. This is what lets your service principal trust Odin’s identity without any shared secret.
3

Grant least-privilege repository access

Add the service principal as a member of your Azure DevOps organisation and grant it, on the nominated repository only:
  • Code (Read) — clone the repository and read pull requests
  • Contribute to Pull Requests — post PR review comments and the status check
No code-push or branch-write, no work-item access, and no organisation- or project-administration rights are required.
4

Test the connection

Back in Odin, click Test connection. Odin mints a token and lists the repositories the service principal can see. A non-zero count confirms both the federation and the Azure DevOps permissions are correct.
5

Register a Service Hook for PR reviews (optional)

Only needed if you want PR Reviews — skip it for pentest-only use. After you save, Odin also shows a webhook URL and an X-Mjolnir-Token header value. Because a least-privilege service principal cannot register webhooks itself, an Azure DevOps organisation admin adds these by hand: in the project’s Service Hooks, create a Web Hooks subscription for both Pull request created and Pull request updated, each posting to the webhook URL with the X-Mjolnir-Token header shown. (The delegated OAuth model registers these automatically.) You still enable PR reviews per repository from the Mjolnir Configuration page.
For the full step-by-step, revocation, and data-handling details — suitable for a security or ISO 27001 review — see the dedicated Service Principal Setup guide.
Authentication vs authorisation. Entra only authenticates the service principal; Azure DevOps decides what it can access through its own permission model. Least privilege is therefore enforced — and revocable — entirely on your side: remove the federated credential or the organisation membership and access stops immediately.

​
Choosing the target repository

However you connect, Odin saves a single target repository for the connection. The Azure DevOps card shows a green checkmark once the connection is active, and you can change the target repository at any time from the same card.

​
Using Azure DevOps with Mjolnir

Once Azure DevOps is connected, it becomes a source option when you set up a Mjolnir run. On the source step of the Mjolnir setup wizard, you can pick a repository to scan, grouped by organisation and project, and choose the branch Mjolnir reads. When you have both GitHub and Azure DevOps connected, the wizard shows a provider toggle so you can choose which one this run uses. With only Azure DevOps connected, the wizard goes straight to the Azure DevOps repository picker. For pull-request feedback, enable PR Reviews per repository from the Mjolnir Configuration page. Mjolnir then posts its review as comments and a status check on each covered pull request.

​
Permissions

What Odin can do depends on the connection model:
  • Delegated (Entra OAuth) — the token acts on behalf of the account that authorised the connection. Odin uses it to read repository contents and metadata for pentesting and, where PR Reviews are enabled, to post review comments and a status check.
  • Service principal (federated) — least privilege, scoped to the nominated repository: Code (Read) and Contribute to Pull Requests. Nothing else is requested or required.
The access token is stored encrypted (Google Secret Manager), is short-lived, and is used only against the repository and pull requests you designate.

​
Notes

  • Azure DevOps is a source-code connection for whitebox pentests and PR reviews. It does not track findings as issues.
  • Issue tracking is handled by Odin’s other integrations. To sync findings into a tracker, connect Linear, Jira, GitHub, or GitLab alongside Azure DevOps.
Work-item sync for Azure DevOps is coming soon. Today the connection covers repository access for whitebox pentesting and pull-request reviews.