---
sourceDocument: Australia IT Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Permissions required for DevOps tools

# Permissions required for DevOps tools {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Permissions required for DevOps tools

This documentation outlines the necessary permissions in various third-party DevOps tools to enable integration with ServiceNow DevOps Change Velocity.
Proper permissions allow ServiceNow to discover repositories, pipelines, work items, and other key elements, as well as to create webhooks and service connections for real-time data synchronization and automation.
Show full answer Show less  

## Azure DevOps Permissions

ServiceNow connects to Azure DevOps with specific access levels, enabling automatic creation of webhooks and service connections without manual configuration by Azure DevOps admins. Key permissions include:

* **Work Items (Read):** To discover boards and receive work items.
* **Code (Read):** To discover repositories and receive branches, commits, and tags.
* **Build (Read and Execute):** To discover build pipelines and control pipeline execution.
* **Release (Read, Write, Execute):** To discover and control release pipelines.
* **Test Management (Read):** To receive test results.
* **Service Connections (Read, Query, Manage):** To create service connections for ServiceNow task configuration.
* **Packaging (Read):** To discover artifact repositories and feeds.
* **Project Administrators:** Required for automatic webhook and service connection creation; the PAT owner must be part of the appropriate administrators group.

**Important:** Tools created with custom access levels may cause webhook duplication upon credential changes; full access level is recommended to avoid this.

## Bitbucket Permissions

* **Account and Projects (Read):** To discover repositories and fetch branches, commits, pull requests, and tags.
* **Webhooks (Read and Write):** To configure real-time data reception.
* **Pull Requests (Read):** To discover and track pull requests.

## GitHub Permissions

GitHub permissions vary depending on authentication method:

* **Basic Authentication:** Requires `repo` permissions for repo discovery, `admin:repohook` for webhook management, and `user:email` for pull request actor details.
* **OAuth 2.0 Authentication:** Requires read-only access to workflows, contents, environments, metadata, secrets, and pull requests; read/write access for deployments and webhooks to enable real-time updates and workflow control.

## GitLab Permissions

* **API (Read and Write):** Enables discovery of plans, repositories, pipelines, and work items, as well as pipeline control and webhook-based real-time updates.

## Jenkins Permissions

* **Overall and Job (Read):** Necessary for discovering pipelines and receiving detailed execution information via the ServiceNow DevOps Jenkins plugin.

## JFrog Permissions

* **Roles Administer Platform:** Required to access artifact details such as name, repository, and version.

## Jira Permissions

* **Groups jira-software-users:** To discover plans and fetch features and stories.
* **Jira Administrators:** Needed to create webhooks for real-time fetching of features and stories.

## Practical Considerations for ServiceNow Customers

Ensuring correct permissions in your DevOps tools is critical for seamless integration with ServiceNow DevOps Change Velocity. These permissions enable automated discovery, real-time updates via webhooks, and pipeline control, reducing manual configuration efforts and improving change velocity management. When onboarding projects or organizations, verify that the Personal Access Token (PAT) owner has the required admin privileges to avoid integration issues.  
Permissions required in your third-party tool to connect to DevOps Change Velocity.

## Azure DevOps permissions {#tool-req-permission__section_nkr_mw5_txb}

Important:  
With the access level permissions specified in the following table in Azure DevOps, and the ServiceNow DevOps extension, you can connect to Azure DevOps from ServiceNow. Your Azure DevOps admin does not have to manually configure webhooks and service connections in Azure DevOps.  
Important:  
* When onboarding a Project, the Project Administrators privilege requires the owner of the PAT to be a member of the project's Project Administrators group.
* When onboarding an Organization, the Project Administrators privilege requires the owner of the PAT to be a member of the organization's Project Collection Administrators group.
{#tool-req-permission__ul_cjw_cvr_szb}  
{#tool-req-permission__table_of5_fy5_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| Work Items | Read | Required to discover the boards and receive the work items either through import, polling, or real time with a configured webhook. |
| Code | Read | Required to discover repositories and receive branches, commits, and tags either through import, polling, or real time with a configured webhook. |
| Build | Read and execute | Read: Required to discover the build pipelines and receive pipeline execution details like stages, artifacts, test results, code security results, and so on, either through import, polling, or real time with a configured webhook. Execute: Required to pause or resume the pipelines based on the change control step. |
| Release | Read, write, and execute | Read: Required to discover the release pipelines and receive pipeline execution details like stages, artifacts, test results, code security results, and so on, either through import, polling, or real time with a configured webhook. Write and Execute: Required to pause or resume the pipelines based on change control step. |
| Test Management | Read | Required to receive test results for pipeline execution. |
| Service Connections | Read, query, and manage | Required to create Service connection automatically which is used to configure ServiceNow tasks like change acceleration, artifact, and package registration, and so on. |
| Packaging | Read | Required to discover the artifact repositories and receive the feeds and packages either through import, polling, or real-time with a configured webhook. |
| Permissions | Project Administrators | Required to create webhooks automatically to receive data in real-time and to create Service connections automatically which is used to configure ServiceNow tasks like change acceleration, artifact and package registration, and so on. |
[ ]

{#tool-req-permission__table_of5_fy5_txb}  

Limitation of Azure DevOps
:   If you create an Azure tool with custom defined access level, and you reconfigure such a tool
    because of change in your Integration user credentials, then the existing service hooks for release created and release deployment are not updated. Instead, two new service hooks are created with new configuration details. To
    avoid the duplication of these service hooks, you must create the tool with full access level.

## Bitbucket {#tool-req-permission__section_ub1_rcv_txb}

{#tool-req-permission__table_zgr_jqv_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| Account | Read | Required to discover repos and fetch branches, commit, pull requests, and tags either through import, polling, or configured webhook. |
| Projects | Read | Required to discover repos and fetch branches, commit, pull requests, and tags either through import, polling, or configured webhook. |
| Webhooks | Read and write | Required to discover repos and fetch branches, commit, pull requests, and tags either through import, polling, or configured webhook. |
| Pull requests | Read | Required to discover repos and fetch branches, commit, pull requests, and tags either through import, polling, or configured webhook. |
[ ]

{#tool-req-permission__table_zgr_jqv_txb}

## GitHub permissions {#tool-req-permission__section_p43_tqv_txb}

The following table lists the GitHub permissions for basic authentication.  
{#tool-req-permission__table_kjv_5qv_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| repo | repo | Required to discover repositories and their respective workflows and receive branches, commits, pull requests, and tags either through import, polling, or real-time with a configured webhook. |
| admin:repo_hook | write:repo_hook | Required to create webhooks automatically to receive repo data in real time. |
| admin:repo_hook | read:repo_hook | Required to lookup already existing webhooks before any new webhook is automatically created to receive repo data in real time. |
| user | user:email | Required to discover pull requests actors like approvers, raised by, merged by, reviewers, and assignees either through import, polling, or real time with a configured webhook. |
[ ]

{#tool-req-permission__table_kjv_5qv_txb}

The following table lists the GitHub permissions required for OAuth 2.0 authentication.  
{#tool-req-permission__table_pzz_pvr_szb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| Actions | Read-only | Required to receive workflows associated to the respective repos real time with a configured webhook. |
| Contents | Read-only | Required to discover repositories and its respective workflows and receive branches, commits, and tags either through import/polling or real time with a configured webhook. |
| Deployments | Read and write | Required to resume the workflow which has environment with ServiceNow change as an environment secret. |
| Environments | Read-only | Required to lookup for existing environment secrets for change creation. |
| Metadata | Read-only | Required to discover repositories and its respective workflows. |
| Secrets | Read-only | Required to get access to environment secrets (to create change). |
| Webhooks | Read and write Note: Read and write permissions are required to configure webhooks from ServiceNow. | Required to create webhook automatically to receive repo data in real time. |
| Pull requests | Read-only | Required to discover pull requests and receive related details like pull request ID, commits, raised by, approvers, comments, reviewers, etc., either through import/polling or real time with a configured webhook. |
| Checks | Read-only | Required to process workflow events associated with private repositories. |
[ ]

{#tool-req-permission__table_pzz_pvr_szb}

## GitLab permissions {#tool-req-permission__section_tpc_dsv_txb}

{#tool-req-permission__table_oqn_mtv_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| api | Read and write | Required to discover plans, repos, and pipelines and receive branches, commit, and tags, and pipeline execution details (like stages, artifacts, test results, code security results), work items, tags, branches, and commits either through import, polling, or real time with a configured webhook. Also, to pause or resume the pipelines based on change control step. |
[ ]

{#tool-req-permission__table_oqn_mtv_txb}

## Jenkins permissions {#tool-req-permission__section_wcc_qtv_txb}

{#tool-req-permission__table_iw3_vtv_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| Overall | Read | Required to discover the pipelines and receive pipeline execution details like jobs or stages, artifacts, test results, code security results, and so on, either through import, polling, or real time with ServiceNow DevOps Jenkins plugin. |
| Job | Read | Required to discover the pipelines and receive pipeline execution details like jobs or stages, artifacts, test results, code security results, and so on, either through import, polling, or real time with ServiceNow DevOps Jenkins plugin. |
[ ]

{#tool-req-permission__table_iw3_vtv_txb}

## JFrog permissions {#tool-req-permission__section_lzp_g5v_txb}

{#tool-req-permission__table_tv3_s5v_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| Roles | Administer Platform | Required to access artifact details like artifact name, artifact repo, and artifact version. |
[ ]

{#tool-req-permission__table_tv3_s5v_txb}

## Jira permissions {#tool-req-permission__section_ezh_q1v_txb}

{#tool-req-permission__table_d2g_1cv_txb__entry__3}

| Object | Permissions required | Impact |
|-|-|-|
| Groups | jira-software-users | Required to discover plans and fetch features, stories, and so on, either through import, polling, or configured webhook. |
| Permissions | Jira Administrators | Required to create webhooks automatically for fetching features and stories in real time. |
[ ]

{#tool-req-permission__table_d2g_1cv_txb}