Claude + Azure DevOps

How Claude Code interacts with Azure DevOps (Azure Boards work items, repos, pipelines) at PSI. Covers authentication, the az boards CLI, and common workflows like creating issues from a chat session.

Organization & Projects

Setting	Value
Organization	`ProgSurface`
Org URL	`https://dev.azure.com/ProgSurface`
Primary project	`Pro App development` — PSI.All source, ProApps work items
Other projects	`Controls`, `Pro Apps - TF`, `Archive`, `Testing`

Most day-to-day desktop/web app work items live in Pro App development. The AB# prefix used in commit messages (see Deploy ProApps) refers to work items in this project.

Authentication

Claude authenticates to Azure DevOps using the same AAD login as the Azure CLI — no PAT required, no secret to store.

One-time

az login

Per-session (what Claude actually runs)

The Azure DevOps resource GUID is 499b84ac-1321-427f-aa17-267ca6975798. Get an access token for it and export as the DevOps CLI env variable:

TOKEN=$(MSYS_NO_PATHCONV=1 az account get-access-token \
  --resource 499b84ac-1321-427f-aa17-267ca6975798 \
  --query accessToken -o tsv)
 
export AZURE_DEVOPS_EXT_PAT="$TOKEN"

From here, all az devops and az boards commands work without further auth.

Why not az devops login? On Windows Git Bash, az devops login tries to use the Windows Credential Manager and often fails with CredWrite errors. The token-as-env-var pattern sidesteps this.

Always set MSYS_NO_PATHCONV=1 before az commands in Git Bash — see MSYS path mangling note.

Common Workflows

Create an issue from a troubleshooting session

Use case: Claude diagnoses a bug and the user wants it tracked as a work item.

az boards work-item create \
  --organization "https://dev.azure.com/ProgSurface" \
  --project "Pro App development" \
  --type "Issue" \
  --title "Short descriptive title" \
  --description "<h3>Problem</h3><p>...</p><h3>Root Cause</h3><p>...</p><h3>Fix</h3><p>...</p>" \
  --query "id" -o tsv

The --description field accepts HTML (Azure Boards renders it as rich text). Use <h3>, <p>, <ul>, <pre>, <code>, </> escapes for angle brackets.

Returns the new work item ID. Link to it with:

https://dev.azure.com/ProgSurface/Pro%20App%20development/_workitems/edit/{ID}

List available work item types

az boards work-item relation list-type \
  --organization "https://dev.azure.com/ProgSurface"
 
# Common types in "Pro App development":
#   Issue, Task, User Story, Bug, Epic, Feature

Show a work item

az boards work-item show --id 934 \
  --organization "https://dev.azure.com/ProgSurface" \
  --query "{id:id,title:fields.\"System.Title\",type:fields.\"System.WorkItemType\",state:fields.\"System.State\"}"

Update a work item

az boards work-item update --id 934 \
  --organization "https://dev.azure.com/ProgSurface" \
  --state "In Progress" \
  --assigned-to "user@progressivesurface.com"

Query work items (WIQL)

az boards query \
  --organization "https://dev.azure.com/ProgSurface" \
  --project "Pro App development" \
  --wiql "SELECT [System.Id], [System.Title], [System.State] FROM workitems WHERE [System.WorkItemType] = 'Issue' AND [System.State] <> 'Closed' ORDER BY [System.CreatedDate] DESC"

List projects

az devops project list \
  --organization "https://dev.azure.com/ProgSurface" \
  --query "value[].name" -o tsv

Git Remotes

Many PSI repos have both GitHub Enterprise and Azure DevOps remotes. Example from PSI.All:

origin       → GitHub Enterprise (primary, CI/CD)
ado          → dev.azure.com/ProgSurface/Pro App development/_git/PSI.All (mirror)
ado-bcall    → dev.azure.com/ProgSurface/Pro App development/_git/PSI.BC.ALL

Use GHE (origin) for code changes and PRs. The ado remote is a legacy mirror. See Deploy ProApps for the authoritative dev workflow.

Work items (Issues, Bugs, Tasks) are still tracked in Azure Boards — that’s where AB# commit references link to.

Linking Commits to Work Items

Commit messages with AB#123 auto-link to work item 123 in Azure Boards. Example:

Fix print dialog crash when no printer selected AB#892

This works for commits on GHE if the repo is mirrored to ADO. For GHE-only repos, reference work items in the PR description instead.

What Claude Can Do Autonomously

Action	Can Claude do it?	Notes
Read work items	Yes	Use `az boards work-item show` or WIQL queries
Create issues / bugs / tasks	Yes	With user confirmation — creates shared state
Update work item fields	Yes	With user confirmation
Close / delete work items	Confirm first	Destructive; ask before acting
Assign work to people	Confirm first	Affects others’ work lists
Create pipelines	Confirm first	Affects shared CI/CD

Treat work item creation like PR creation — it’s visible to others, so confirm intent before acting unless the user explicitly asked for it in the same turn.

Troubleshooting

`The user is not authorized to access this resource.`

The AAD token is valid but your account isn’t mapped to that ADO organization. Verify:

You’re signed into Azure CLI with @progressivesurface.com account (az account show)
You can see the org at https://dev.azure.com/ProgSurface in a browser
You got a fresh token (they expire hourly — re-run the az account get-access-token line)

`CredWrite: The stub received bad data`

Don’t use az devops login on Windows Git Bash. Use the AZURE_DEVOPS_EXT_PAT env variable pattern above.

`Before you can run Azure DevOps commands, you need to run the login command`

The AZURE_DEVOPS_EXT_PAT env variable didn’t carry over — it doesn’t persist between shell invocations. Re-export it at the start of each session:

export AZURE_DEVOPS_EXT_PAT=$(MSYS_NO_PATHCONV=1 az account get-access-token \
  --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv)

Path mangling on Git Bash

MSYS/Git Bash rewrites Unix-style paths in command arguments (e.g. /Pro App development → C:/Program Files/Git/Pro App development). Always prefix az commands with MSYS_NO_PATHCONV=1:

MSYS_NO_PATHCONV=1 az boards work-item create ...

Or export it once per session:

export MSYS_NO_PATHCONV=1

REST API Fallback

When the CLI is insufficient, use the Azure DevOps REST API directly:

TOKEN=$(MSYS_NO_PATHCONV=1 az account get-access-token \
  --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv)
 
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://dev.azure.com/ProgSurface/Pro%20App%20development/_apis/wit/workitems/934?api-version=7.0"

API reference: https://learn.microsoft.com/rest/api/azure/devops/

Claude Code Integration — Wiki-specific Claude setup (commands, skills, CLAUDE.md)
Agentic Implementation — How Claude is used for production work at PSI
Deploy ProApps — AB# commit reference pattern for linking commits to work items
Connect AI Agents — Setup guide for CLAUDE.md and MCP

Last updated: April 2026

PSI Knowledge Base

Explorer

claude-azure-devops

Claude + Azure DevOps

Organization & Projects

Authentication

One-time

Per-session (what Claude actually runs)

Common Workflows

Create an issue from a troubleshooting session

List available work item types

Show a work item

Update a work item

Query work items (WIQL)

List projects

Git Remotes

Linking Commits to Work Items

What Claude Can Do Autonomously

Troubleshooting

`The user is not authorized to access this resource.`

`CredWrite: The stub received bad data`

Path mangling on Git Bash

REST API Fallback

Graph View

Table of Contents

Backlinks

PSI Knowledge Base

Explorer

claude-azure-devops

Claude + Azure DevOps

Organization & Projects

Authentication

One-time

Per-session (what Claude actually runs)

Common Workflows

Create an issue from a troubleshooting session

List available work item types

Show a work item

Update a work item

Query work items (WIQL)

List projects

Git Remotes

Linking Commits to Work Items

What Claude Can Do Autonomously

Troubleshooting

The user is not authorized to access this resource.

CredWrite: The stub received bad data

Before you can run Azure DevOps commands, you need to run the login command

Path mangling on Git Bash

REST API Fallback

Related Pages

Graph View

Table of Contents

Backlinks

`The user is not authorized to access this resource.`

`CredWrite: The stub received bad data`

`Before you can run Azure DevOps commands, you need to run the login command`