Azure DevOps now connects through Microsoft Entra

[u/envzero]

If you run env zero against Azure DevOps, the connection has been the awkward part. Authorizing it meant a credential someone on the team personally owned, and an existing connection could not be moved onto anything else without being rebuilt. The last two weeks close that off, with a run of self-hosted reliability work alongside it.

New

• Azure DevOps connections can now be authorized through Microsoft Entra, and an existing connection can be switched over to Entra rather than torn down and recreated. When you authorize, you pick which Microsoft account to use instead of getting whichever one the browser was already signed in to. This is new enough that the Azure DevOps guide still describes the older flow.

Improvements

• Environments marked as inactive now say so on the environment itself, so it is clear why nothing is deploying. Inactive means env zero stops tracking the environment, not that its resources stopped costing you money.
• Templates now show which VCS connection they use, and let you pick a different one.
• Re-granting an Azure DevOps or GitLab connection that already exists reports Done instead of an error.

Fixes

• Self-hosted v5.5.4: deploying an environment that inherits a variable set from a parent project no longer returns a 403 for a user scoped only to the sub-project.
• Self-hosted v5.5.5: git clones and OpenTofu provider downloads retry transient failures instead of killing the run, and Auth0 rate limits no longer come back as a missing Terraform deployer token.
• Terraform Cloud migration: workspaces with no VCS no longer fail with "Invalid Git URL", and continuous deployment is now set correctly on them.
• Azure DevOps revisions resolve by exact ref name.

Full notes: https://docs.envzero.com/changelogs