Connect Azure DevOps

What it pulls

Organization + projects, Git repositories, completed builds over the last 30 days (deployment frequency + change-failure rate), and Boards work items (30-day throughput, created→closed lead time, open/aging) for Delivery Health; plus, across a repository sample, latest-commit staleness (legacy-code debt) and Advanced Security alerts (CodeQL/SAST, dependency, secret) for Security Readiness. A 403/not-enabled Advanced Security response is omitted rather than faked as a clean 0.

The exact fields the connect form asks for — and where to find each value.

Organization

The “your-org” part of the dev.azure.com/your-org web address (your organization, not a project).

Personal Access Token

dev.azure.com/<org>/_usersSettings/tokens → New Token → Custom defined → Read for Code, Build, Work Items, Project & Team. Optionally Advanced Security → Read to ingest native SAST alerts. Copy it (shown once).

Project (optional — limits the sync to one project)

Leave blank to sync the whole organization; set a project name to limit the sync to just that project.

1. 1

   Find your organization name

   Sign in at dev.azure.com — the URL shows dev.azure.com/<your-org>. That <your-org> segment is your Organization (NOT a project name). No org yet? Create one there first.

2. 2

   Open the tokens page directly

   Go to https://dev.azure.com/<your-org>/_usersSettings/tokens (replace <your-org>) to land straight on Personal Access Tokens.

3. 3

   Create a token with Custom scopes

   New Token → name it “ShipReady Metrics”, pick your organization, set an expiration, then switch the scope view from Recommended to “Custom defined”.

4. 4

   Grant read-only scopes

   Under Custom defined, check Read for Code, Build, Work Items, and Project & Team. Optionally also check Advanced Security → Read so native SAST/dependency/secret alerts ingest; without it, Delivery Health and Technical Debt still populate and Security Readiness omits vuln density rather than faking a clean 0. Leave everything else unchecked.

5. 5

   Create + copy, then connect

   Click Create and copy the Personal Access Token now (shown once). Back here: put your org (dev.azure.com/<org> or just the name) in Organization, paste the token into Personal Access Token, optionally set a single Project, and click Connect.

Troubleshooting

Security Readiness shows no vulnerabilities / Advanced Security findings.

GitHub Advanced Security for Azure DevOps must be enabled on the organization and the PAT needs Advanced Security → Read (`vso.advsec`). A 403/not-enabled response is omitted rather than faked as a clean 0 — Delivery Health and Technical Debt still populate.