Error when trying to "Register Webhooks" in Azure DevOps Project

[Simen S_ther1]

Hey, 

I am setting up the Microsoft Azure DevOps Integration for Agile Development. 

When I try to Register Webhooks between my project in SN and in Azure DevOps, I get the following error message in sys logs: 

Error

Access Denied: 65d28eec-e217-622f-b92b-9293b678962a needs the following permission(s) on the resource PublisherSecurity/9726da8d-76c1-4f75-a3a2-14b797c04418 to perform this action: Edit Subscription

sn_azure_dev_spoke

My thought is that my access token in Azure do not have enough permissions. Anyone know what is required or if it might be another reason I can't get the connect? Everything else has been syncing fine up until now.  

[Ayda Abdullah]

Hi Simen, did you manage to solve the issue as I am also experiencing the same?

[Chris Everding]

Hi Simon,

It appears as if the user that created the PAT doesn't have permission to edit webhooks in ADO.

You'll need to speak with your ADO admins to either have them create the PAT from an account that does, or provide you with access to edit webhooks.

Thanks,

Chris

[Ryan Bader]

so i had a very similar issue to this and the solution is to login to ServiceNow using the https://<instance name>.service-now.com/login.do with the account you want setup as the service account for the integration. then get your OAuth token. you will be prompted to login to AD with the current logged in user. then you will be able to register your webhook. 

[Daxin]

As the original post was 2022 its safe to assume that only PAT was supported OOB. 

There has been lot of changes happened recently and would like to add few more inputs on what the issue could be.

The error is that the webhook is not created due to permission issues.

There could be 2 scenarios 

1. The PAT token/OAuth generated for that account does not have the permission 

2. The token was generated for the incorrect account(which did not have permission)

If the issue is due to 1 then the ADO admin has to contacted as mentioned by Chris in the above post.

Issue 2 is common for system that has SSO enabled and automatically creates access token of the logged in user.  However one might be able to login as service account because  it might not exist in ServiceNow(some organization might not sync these type of accounts from AD) and its always not necessary to have this account created in ServiceNow as it is required to authenticate in ADO and not in ServiceNow.