--- sourceDocument: Australia IT Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # Azure DevOps PAT scopes for DevOps # Azure DevOps PAT scopes for DevOps {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Azure DevOps PAT scopes for DevOps When integrating Azure DevOps with ServiceNow DevOps, configuring Personal Access Tokens (PATs) with the correct scope access levels is essential for seamless functionality. These scopes determine the permissions that allow ServiceNow to interact with Azure DevOps resources such as boards, repositories, pipelines, and service connections without requiring manual configuration of webhooks or service connections by Azure DevOps administrators. Show full answer Show less Note that the PAT owner must belong to specific administrative groups depending on whether you are onboarding a Project or an Organization, to ensure proper privileges. ## Scope Access Levels per Capability * **Boards (Work items):** Requires *Read* scope to discover boards and receive work items through import, polling, or real-time webhooks. * **Repos (Code):** Requires *Read* scope to discover repositories and receive branches, commits, and tags similarly. * **Build Pipelines:** Needs both *Read* (to discover builds and retrieve pipeline execution details including artifacts and test results) and *Execute* scopes (to pause/resume pipelines during change control steps). * **Release Pipelines and Gates:** Requires *Read, Write, and Execute* access to discover releases, receive execution details, and control pipeline pause/resume actions. * **Test Management:** Requires *Read* access to receive test results from pipeline executions. * **Service Connections:** Requires *Read, Query, and Manage* access to automatically create service connections that facilitate ServiceNow tasks like change acceleration and artifact registration. * **Packaging:** Requires *Read* access to discover artifact repositories and receive feeds and packages. ## Important Considerations * The PAT owner must be a member of the Project Administrators group for Project onboarding, or the Project Collection Administrators group for Organization onboarding. * You must have the **Update build information** permission on your pipeline in Azure DevOps for all pipeline features to function correctly. Contact your Azure DevOps Project Administrator if this permission is missing. * When updating an Azure tool with custom access levels due to credential changes, existing service hooks for release and deployment are not updated. Instead, duplicate service hooks are created. To prevent this, create the tool with full access level from the start. Scope access levels are required when using a personal access token (PAT) to access Azure DevOps during setup. Scope access level settings are based on the capability you have configured. Set the corresponding access level for seamless functionality. For information on creating a PAT, see [Personal access token (PAT)](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page). Important: With the access level permissions specified in the following table in Azure DevOps, and the ServiceNow DevOps extension, you can connect to Azure DevOps from ServiceNow. Your Azure DevOps admin does not have to manually configure webhooks and service connections in Azure DevOps. Important: * When onboarding a Project, the Project Administrators privilege requires the owner of the PAT to be a member of the project's Project Administrators group. * When onboarding an Organization, the Project Administrators privilege requires the owner of the PAT to be a member of the organization's Project Collection Administrators group. {#dev-ops-pat-scopes-azure__ul_kdb_f4d_cxb} {#dev-ops-pat-scopes-azure__table_pat_ado__entry__4} | Capability | Scope | Access level | Impact | |-|-|-|-| | Boards | Work item | Read | Required to discover the boards and receive the work items either through import/polling or real time with a configured webhook. | | Repos | Code | Read | Required to discover repositories and receive branches, commits, and tags either through import/polling or real time with a configured webhook. | | Build pipelines | Build | Read \& Execute | * Read: Required to discover build and receive pipeline execution details like stages, artifacts, test results, code security results, etc., either through import/polling or real time with a configured webhook. * Execute: Required to pause/resume the pipelines based on the change control step. {#dev-ops-pat-scopes-azure__ul_m4g_q33_gvb} | | Release pipelines and gates | Release | Read, write and execute | * Read: Required to discover release and receive pipeline execution details like stages, artifacts, test results, code security results, etc, either through import/polling or real time with a configured webhook. * Write and Execute: Required to pause/resume the pipelines based on change control step. {#dev-ops-pat-scopes-azure__ul_g1v_t33_gvb} | | Test build and release pipelines | Test management | Read | Required to receive test results for pipeline execution. | | Service Connections | Service connection | Read, query, and manage | Required to create Service connection automatically which is used to configure ServiceNow tasks like change acceleration, artifact and package registration, etc. | | Packaging | Packaging | Read | Required to discover the artifact repositories and receive the feeds and packages either through import/polling or real-time with a configured webhook. | [Table 1. Scope access level settings per capability and their impact] {#dev-ops-pat-scopes-azure__table_pat_ado} Note: You must have the Update build information permission on your pipeline for all pipeline features to work seamlessly. Contact your ADO Project Administrator if you don't have this permission. ## Limitation of Azure DevOps {#dev-ops-pat-scopes-azure__section_jkx_wfp_gwb} If you create an Azure tool with custom defined access level, and you reconfigure that tool because of change in your Integration user credentials, then the existing service hooks for release created and release deployment aren't updated. Instead, two new service hooks are created with new configuration details. To avoid the duplication of these service hooks, you must create the tool with full access level.