Azure DevOps fails to add Graph Connector Federated Credential App required by Microsoft 365 Copilot Azure DevOps Work Items connector

John Jairo Céspedes Blanco (Ext. 140) 0 Puntos de reputación
2026-08-07T15:40:50.9+00:00

We are configuring the official Microsoft 365 Copilot connector "Azure DevOps Work Items" using Federated Credential authentication.

Microsoft 365 Support previously reviewed the environment under case:

TrackingID#2608050040009036

and concluded that tenant configuration and permissions appear to be correctly configured. We were advised to open the case through Azure support.

Environment:

Azure DevOps organization:

xxxxxxxxxxxxxxxxxxxxxxxxxx

Microsoft Entra tenant:

xxxxxxxxxxxxxxxxxxxxxxx

Validated prerequisites:

  • Azure DevOps organization is connected to the correct Microsoft Entra tenant.
  • User Access Level = Basic.
  • User is Organization Owner.
  • User is Project Collection Administrator.
  • Third-party application access via OAuth is enabled.
  • Microsoft 365 Copilot connector partially creates successfully.

Problem:

According to Microsoft documentation for the Azure DevOps Work Items connector, Federated Credential authentication requires the following Microsoft-published service principal:

Graph Connector Federated Credential App

Application ID:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Azure DevOps resolves this App ID correctly and displays:

Graph Connector Federated Credential App

Reproduction steps:

  1. Azure DevOps
  2. Organization Settings
  3. Users
  4. Add Users
  5. Enter App ID xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  6. Azure DevOps correctly resolves the identity
  7. Access Level = Basic
  8. Azure DevOps Group = Project Administrators
  9. Projects selected
  10. Send email invites disabled
  11. Add

Actual result:

Failed: Add 1 user

Detailed error:

Given email address 'Graph Connector Federated Credential App' is invalid.

Expected result:

Azure DevOps should successfully add the service principal as required by the Microsoft 365 Copilot Azure DevOps Work Items connector documentation.

Question:

Why does Azure DevOps successfully resolve the service principal but then attempt to validate its display name as an email address?

Could Microsoft please confirm:

  1. Whether Graph Connector Federated Credential App is correctly provisioned in our tenant.
  2. Whether this service principal should be added by another method.
  3. Whether this is a known issue between Azure DevOps and the Microsoft 365 Copilot Azure DevOps Work Items connector.

I have screenshots and a complete evidence package available if required.

Azure DevOps
0 comentarios

2 respuestas

Ordenar por: Lo más útil
Lo más útil Más reciente Menos reciente
  1. John Jairo Céspedes Blanco (Ext. 140) 0 Puntos de reputación
    2026-08-07T17:33:19.54+00:00

    Thank you, Rukmini.

    I appreciate the detailed response.

    I have now completed the checks you mentioned:

    • Azure DevOps is connected to the correct Microsoft Entra tenant.
    • My account has Basic access.
    • My account is Organization Owner.
    • My account is Project Collection Administrator.
    • The Add Users dialog displays "Users or Service Principals".
    • Send email invites is disabled.
    • Project Administrators permissions were assigned.

    I also searched for the App ID 933838e2-bec1-440f-a634-9363c82e5b6d in Microsoft Entra Enterprise Applications and no results were returned.

    At the same time, Azure DevOps is able to resolve the App ID and display "Graph Connector Federated Credential App", but the add operation fails with:

    "Given email address 'Graph Connector Federated Credential App' is invalid."

    An Azure DevOps Support Engineer has now been assigned to Case #2608050040009036 and a remote troubleshooting session has been scheduled for today.

    I will preserve the current configuration and share the findings from the support session once we identify the root cause.

    Thank you again for your guidance.

    ¿Le resultó útil esta respuesta?

  2. Rukmini 43,995 Puntos de reputación Personal externo de Microsoft Moderador
    2026-08-07T16:12:09.2466667+00:00

    @John Jairo Céspedes Blanco (Ext. 140)

    El problema se resolverá cambiando el método de autenticación a Microsoft Entra ID OAuth y configurando correctamente el registro de la aplicación.

    Pasos realizados:

    Revisamos el entorno y confirmamos que se estaba utilizando Federated Credential. Aunque es una opción de autenticación recomendada, procedimos con Microsoft Entra ID OAuth para la resolución del problema.

    Creamos un App Registration en Azure Portal con un secreto de cliente.

    Agregamos el App Registration como usuario en la organización de Azure DevOps con acceso Basic.

    Asignamos permisos de Project Reader a los proyectos correspondientes.

    Durante la autorización, se produjo el siguiente error:

    AADSTS650057: Invalid resource

      Esto indicó que faltaban los permisos de API necesarios en el App Registration.
  
  Agregamos los **permisos de API** necesarios al App Registration y volvimos a intentar la autorización.
  
  Posteriormente, apareció el siguiente error:
  
     `AADSTS500113: No reply address is registered for the application`
     
     En **App Registration → Authentication**, agregamos una plataforma **Web** y configuramos la URI de redireccionamiento correspondiente de Microsoft 365 Copilot: `https://gcs.office.com/v1.0/admin/oauth/callback`
     
     Volvimos a intentar la autorización del conector después de completar la configuración.

    La conexión se estableció correctamente entre Azure DevOps y Microsoft 365 Copilot.

    ¿Le resultó útil esta respuesta?

    0 comentarios

Su respuesta

Las respuestas pueden ser marcadas como Respuestas aceptadas por el autor de la pregunta, lo que indica a los usuarios que la respuesta resolvió su problema.