Azure DevOps Board Spoke w/OAuth error: "Identity xxx has not been materialized..."

[Kelly Logan]

We tried to Set up the Microsoft Azure DevOps Boards spoke using OAuth. We configured Azure DevOps by using a current app registration, confirming the values were correct and then creating a new secret. We then created a connection as described and were able to receive an Oauth token successfully.
Then we created an Azure DevOps Instance using that connection alias we just created. When we tried to use the 'Connect' button to test the connection, we received the error message, "Error Message: Cannot establish connection. Please refer logs for more details."
When we checked the Azure Devops Logs, we saw an error that started with "Instance : yyy Azure DevOps, Action : Connect, Message : Cannot establish connection. Please refer logs for more details.; JSON = "<!DOCTYPE html >\r\n<html>\r\n <head>\r\n <title>Identity xxx has not been materialized, please use interactive login over the browser first.</title>\r\n "

Looking up this error, we see advice about using an interactive login to 'materialize' this identity, but principals like we are using don't allow interactive logins.

Troubleshooting:
1. We confirmed the app id, tenant id and secret value are all correct. 
2. We tried the URL "https://dev.azure.com" instead - Still able to get an OAuth token, but using the 'Connect' button from the instance form then resulted in an error log with the title "Resource not found".
3. We confirmed the permissions for the Azure app were correct.

Has anyone dealt with this issue previously and found a way around this need for login with a service principal on Azure DevOps?

[Tanushree Maiti]

Hi @Kelly Logan 

Its an error of Azure end . If you check Azure Devops community , gitHub site, similar issues have been reported before.

I will suggest to check with Azure devOps product/vendor Support for the assistance.

[Kelly Logan · Accepted solution]

What's happening: The OAuth part works, which is why ServiceNow gets a token from Entra ID. The failure comes after that, at Azure DevOps. Azure DevOps keeps its own list of users for each organization, and the service principal (the app registration) isn't on it yet. A normal user gets added automatically the first time they open Azure DevOps in a browser, which is what "materialized" means. A service principal can't log in through a browser, so it never adds itself.

MFA isn't the cause. Service principals aren't subject to MFA.

Fix (needs an Azure DevOps admin)

1. In Azure DevOps, go to Organisation Settings → Users → Add users.
2. Search for the app registration's name and add it with access level Basic.
3. Add it to the target project as Contributors, or whatever group gives it the access it needs on Boards.
4. In ServiceNow, keep the original token scope. Don't switch to https://dev.azure.com, because that's what caused the "Resource not found" error.
5. Check that the instance URL in ServiceNow is https://dev.azure.com/<orgname>.
6. Click Connect again.
   
   

Also check that the Azure DevOps org is connected to the same Entra tenant as the app registration (Organisation Settings → Microsoft Entra).

After these changes were made, we were able to authenticate.