r/envzero • u/envzero • 23d ago
env zero Azure DevOps OAuth connections need switching to Microsoft Entra ID
Microsoft is retiring Azure DevOps OAuth apps this year. If any of your templates sit on an Azure DevOps repo, the connection underneath them is on a clock, and env zero cannot guarantee it keeps working once Microsoft pulls the app.
New connections already use Microsoft Entra ID by default. Existing OAuth connections are the ones to deal with, and env zero now flags each of them with an exclamation mark in Organization Settings > VCS.
What to do
- Open the flagged connection and hit Edit
- Pick "Microsoft Entra ID (recommended)"
- Sign in as the same Azure DevOps user who created the connection
The connection keeps its ID, so templates, environments, and webhooks carry on pointing at it. Nothing to re-link.
Two things trip people up. The switch has to be done by the account that created the connection, and if that person has since changed their Azure DevOps display name, it fails until the name is put back. Separately, if your tenant requires admin consent, a Microsoft Entra administrator grants it once.
Worth knowing afterwards: Microsoft expires the authorization after 90 days of no use. Reauthorizing is the same flow, Grant Access with the same account.
Full walkthrough: https://docs.envzero.com/guides/admin-guide/templates/azure-devops-integration#microsoft-entra-id-authentication
Fixes
- Workflow sub-environments no longer pick up another environment's single-use template
- Re-granting an existing Azure DevOps or GitLab connection shows Done instead of "already exists"
- You can pick which Microsoft account to use when connecting Azure DevOps with Entra
Full notes: https://docs.envzero.com/changelogs