Integrate Azure DevOps with Jira Align using Microsoft Entra ID OAuth

Summary

Microsoft has deprecated the legacy Azure DevOps OAuth 2.0 implementation, preventing new application registrations. This article provides the steps to integrate Azure DevOps with Jira Align using Microsoft Entra ID (formerly Azure AD) OAuth.

As of early 2024, Microsoft disabled the creation of new OAuth applications using the legacy Azure DevOps method. To maintain connectivity, integrations must now use Microsoft Entra ID app registrations configured as multi-tenant applications to support the OAuth endpoints used by the Jira Align connector.

Solution

To establish a connection between Jira Align and Azure DevOps (ADO) using modern authentication, you must create an app registration in Microsoft Entra ID and then configure the connector settings in Jira Align.

Step 1: Create Microsoft Entra app registration

1. Navigate to the Microsoft Entra admin center.

2. Go to Applications, then App registrations, and select New registration.

3. Enter a name for the application, such as Jira Align ADO Connector(or your preferred name).

4. Under Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

   Note: The Jira Align connector uses the "/organizations" OAuth endpoint, which requires the application to be configured as multi-tenant. Single-tenant configurations will result in a 400 Bad Request error during authorization.

5. In the Redirect URI section, set the type to Web and enter the following URL, replacing <yourinstancename> with your actual Jira Align instance name:

   https://<yourinstancename>.jiraalign.com/privateapi/tfsConfig/oauth/callback

6. Select Register.

7. From the Overview page, copy and save the Application (client) ID and the Directory (tenant) ID for later use.

Step 2: Create a client secret

1. In the app registration, go to Certificates & secrets, then select New client secret.

2. Add a description and set an expiration period (Atlassian recommends 12 to 24 months).

3. Select Add.

4. Copy the Value of the secret immediately. You will not be able to view this value again after leaving the page.

Step 3: Configure API permissions

1. Go to API permissions, then select Add a permission.

2. Select Azure DevOps from the list.

3. Select Delegated permissions.

4. Search for and add the following scopes:

   • https://app.vssps.visualstudio.com/vso.identity_manage - Identity (manage

   • https://app.vssps.visualstudio.com/vso.memberentitlementmanagement - Member Entitlement Management (read)

   • https://app.vssps.visualstudio.com/vso.project_manage - Project and team (read, write and manage)

   • https://app.vssps.visualstudio.com/vso.work_full - Work items (full)

5. Select Add permissions.

Step 4: Enable Third-Party OAuth in Azure DevOps

1. Log in to your Azure DevOps organization.

2. Go to Organization Settings, then Policies.

3. Ensure the toggle for Third-party application access via OAuth is enabled.

4. Select Save.

Step 5: Configure the Jira Align connector

1. In Jira Align, go to Admin, then Azure DevOps Settings.

2. Select Add Connector or edit an existing one.

3. Set the Authentication Method to OAuth - Microsoft Entra.

4. Enter the following details gathered in previous steps:

   • App ID: The Application (client) ID.

   • Client Secret: The secret value created in Step 2.

   • Directory ID: The Directory (tenant) ID.

   • Callback URL: https://{yourinstancename}/privateapi/tfsConfig/oauth/callback

   • Authorized Scopes: (The scopes added from Step 3.4)

5. Select Save to store the configuration.

6. Select Authorize and Get Token. You will be redirected to Microsoft to sign in and provide consent.

7. Once redirected back to Jira Align, verify the button now displays Re-Authorize And Get Token" indicating a successful connection.

8. Complete the remaining ADO connector configuration (project mappings, etc.)

9. Activate the connector