Issue with logs on Azure DevOps pipeline execution console when application user not added to team

[Bartosz Glowac1]

Hi,

I have set up my ServiceNow PDI with DevOps Change Velocity app, made connection with Azure DevOps (also developer clear instance) according to the documentation
Setting up Azure DevOps OAuth 2.0 credential

I would like to avoid the step of adding the registered app to each and every project "default team" group. 

If I omit this step and finish one before -  at adding the registered app as user in organization and setting it as project administrator everything works well regarding change creation on ServiceNow DevOps side, everything goes through all states of simplified model and successfully closes, however in ServiceNow DevOps logs the following error shows up

"Intended information was not appended to Azure DevOps console. Authorization credentials do not have the minimum required permissions."

Of course I do not see then logs from ServiceNow on Azure DevOps pipeline execution console.

Questions:

1. is there any other influence of this approach either on ServiceNow side or ADO side than "just" lack of the logs in ADO pipeline execution console?

2. Is it possible to add the registered app user to some group on organization level so that it will gain the permissions of adding logs on the projects? It is strange form me that even the app registration user is added to project administrators it has no rights to add logs and adding it on project level to default project team is required. Any advice here? I would like to avoid entering each and every project to add the user to project team so that everything could work.

I will be thankful for any support here, thanks.

Bartosz

[Bartosz Glowac1 · Accepted solution]

I guess I have found solution to my problem. 

So I do not add the registered app user Admin Permission at each and every project level via Organization settings-> User->Manage access

Instead in Organization settings->Permissions I add my registered app user to two following groups:

"Project Collection Administrators"

"Project Collection Build Service Accounts"

With this I do not need to set up anything with at the individual projects level under my organization (apart from their pipelines set-up of course) to successfully onboard these project into ServiceNow DevOps Tool. 

Webhooks are being automatically configured at each and every project I configure via ServiceNow workspace and when all the rest about pipeline steps change creation is done, changes are being properly created and Azure DevOps logs are being updated with the messages sent from ServiceNow about approvals.

This speeds up existing and the new projects onboarding process, as the project admin needs just to modify their pipeline to include ServiceNow Change Creation step, and all the rest can be done from the ServiceNow DevOps Workspace.