Workfront Fusion now supports Azure DevOps using a service principal

Connect Azure DevOps to Workfront Fusion using a service principal

You can create a connection that uses a service principal (an Application API connection) instead of a personal account. Use this when you want the integration to run as an application or service identity rather than a specific person — for example, to avoid breakage when someone leaves the company or changes credentials. This connection type is available for all Azure DevOps modules.

Overview

Service principal connections let Fusion authenticate to Azure DevOps as an application identity (an app registration in Microsoft Entra ID) using a client secret. After you register the app and add it as a user in your Azure DevOps organization, create a Service Principal connection in the Azure DevOps module and provide the Tenant ID, Client ID, Client Secret, and organization name.

NOTE: Service principal authentication does not support every Azure DevOps feature. A small number of admin-level actions — for example, managing user licenses or other tenant-admin-only tasks — still require a personal account connection. Use a service principal when you only need work items, boards, repos, pipelines, and similar non-admin operations.

Prerequisites

• Global Administrator or Application Administrator access in Microsoft Entra ID to create the app registration (or have your identity team perform this step).
• Project Collection Administrator access in your Azure DevOps organization to add the service principal as a user.
• The name of your Azure DevOps organization (the segment in dev.azure.com/<your organization name>).

Step 1 — Create the app registration in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Go to App registrations > New registration.
3. Give the app a clear name (for example, Workfront Fusion Azure DevOps Integration).
4. Leave Redirect URI blank — this connection does not use interactive browser sign-in.
5. Select Register.

Step 2 — Create a client secret

1. Open your new app registration and go to Certificates & secrets.
2. Select New client secret, add a description, choose an expiry, and select Add.
3. Copy the secret Value immediately — it is shown only once. If you navigate away you must create a new secret.

Step 3 — Collect the connection details

From the app registration Overview page, note the following values for the connection setup:

• Tenant ID — Directory (tenant) ID on the Overview page.
• Client ID — Application (client) ID on the Overview page.
• Client Secret — The secret Value you copied.
• Organization — Your Azure DevOps organization name (the folder in dev.azure.com/yourorg).

NOTE: You can skip adding API permissions in the app registration. Azure DevOps does not expose application permissions via the Azure portal the same way; access is granted directly inside Azure DevOps (next step).

Step 4 — Add the service principal to your Azure DevOps organization

1. Sign in to your Azure DevOps organization at dev.azure.com/<your organization name>.
2. Open Organization settings (lower left) > Users, then select Add users.
3. Search by the app's display name (the name you registered in Entra). Do not search by Client ID.
4. Select an access level:
   • Basic — usually sufficient for reading/writing work items, boards, repos, and pipelines.
   • Project Collection Administrators — required only if your workflow must browse or manage collection-level processes (Agile, Scrum, custom templates) during setup. Grant this only when necessary.
5. Assign the app to the specific project(s) it needs and select Add.

Step 5 — Create the connection in Workfront Fusion

1. Open an Azure DevOps module in the Fusion canvas and start creating a new connection.
2. Select the Service Principal (Application API) connection type.
3. Enter Tenant ID, Client ID, Client Secret, and Organization.
4. Save the connection. If the app registration and Azure DevOps user mapping are correct, the connection will validate successfully.

Behavior and tips

• Use a service principal for non-personal, long-lived integrations so they don’t break when people change accounts.
• If a workflow requires collection‑level configuration discovery (process templates) you may need to add the app to Project Collection Administrators during setup — otherwise Basic is usually enough.
• Test the connection with the modules you plan to use (work items, repos, pipelines) to confirm permissions are adequate before switching production scenarios over to the service principal.
• Rotate client secrets periodically and update the Fusion connection when you create a new secret to avoid unexpected outages.
• Keep descriptive app names and notes in both Entra and Azure DevOps so admins recognize the purpose and environment (dev/staging/prod).

Where to find documentation

For step-by-step guidance and troubleshooting, see the Experience League documentation for Azure DevOps connector setup and Microsoft Entra ID app registration. 

Need help or want to give feedback?

If you have questions, encounter issues, or want to suggest improvements (for example, clearer permission guidance, service principal role templates, or programmatic management of connections), post a comment on the Experience League article, start a thread in the Experience League Community, or contact Adobe Support through the Admin Console Support portal. Your feedback helps us prioritize future enhancements.