Setup is two steps, done by two different people: your Azure administrator
registers an app in Entra ID, then an Athena workspace admin saves that app
once for the whole workspace. Members can only connect after both are done.
What connecting Azure DevOps unlocks
- List projects and teams in your organization.
- Search work items with WIQL, and read individual work items with their fields and history.
- Create and update work items from chat.
- List iterations and the work items in a given sprint.
Step 1 — Register an Entra ID application (Azure admin)
-
Azure Portal → Microsoft Entra ID → App registrations → New
registration. Name it e.g.
Athena — Azure DevOps. -
Redirect URI: platform Web, value:
Entra compares redirect URIs as exact strings — trailing slashes and scheme mismatches fail the handshake.
-
API permissions → Add a permission → Azure DevOps → Delegated permissions →
user_impersonation, then Grant admin consent so members aren’t prompted individually. - Certificates & secrets → New client secret. Copy the Value right away — Entra shows it once.
- Overview: copy the Application (client) ID and Directory (tenant) ID.
Your Azure DevOps organization must be connected to the same Entra tenant.
Step 2 — Enable Azure DevOps in Athena (workspace admin, once)
An Athena workspace admin or owner must add this on the Athena side for the entire workspace before individual members can connect their Azure DevOps organizations. Members cannot configure it themselves. Open Workspace Settings → Treasury → Integrations, expand Azure DevOps, toggle it on, and fill in:
The client secret is encrypted before storage and is never returned to the
browser.
Step 3 — Members connect (each user)
- Go to Integrations and click Azure DevOps → Connect.
- Sign in to Microsoft in the popup and consent to Azure DevOps user_impersonation.
- Pick the Azure DevOps organization you want. Athena creates a private catalog for you, and the Azure DevOps tools become available in chat.