The Azure DevOps Audit Logs (via Codeless Connector Platform) connector requires an App Registration and client secret, but it also uses delegated OAuth authorization and depends on the authorizing user retaining the Azure DevOps View audit log permission.
This creates a long-term dependency on an interactive user account for a service-to-service integration.
Context
In our testing:
The configured Service Principal could successfully query the Azure DevOps Audit API using an app-only token.
Connector deployment failed with 403 Forbidden.
The deployment succeeded only after granting the authorizing user the Azure DevOps View audit log permission.
This indicates that connector validation depends on the delegated user context in addition to the configured application identity.
Suggested improvement
Please consider:
Supporting app-only authentication using the configured application identity, where technically possible.
Otherwise, clarifying why delegated user authorization is required and why the App Registration and client secret alone are insufficient.
Reducing the dependency on a human identity would make the connector more suitable for long-running production ingestion and less vulnerable to permission changes, account lifecycle events, or staff turnover.
The Azure DevOps Audit Logs (via Codeless Connector Platform) connector requires an App Registration and client secret, but it also uses delegated OAuth authorization and depends on the authorizing user retaining the Azure DevOps View audit log permission.
This creates a long-term dependency on an interactive user account for a service-to-service integration.
Context
In our testing:
The configured Service Principal could successfully query the Azure DevOps Audit API using an app-only token.
Connector deployment failed with 403 Forbidden.
The deployment succeeded only after granting the authorizing user the Azure DevOps View audit log permission.
This indicates that connector validation depends on the delegated user context in addition to the configured application identity.
Suggested improvement
Please consider:
Supporting app-only authentication using the configured application identity, where technically possible.
Otherwise, clarifying why delegated user authorization is required and why the App Registration and client secret alone are insufficient.
Reducing the dependency on a human identity would make the connector more suitable for long-running production ingestion and less vulnerable to permission changes, account lifecycle events, or staff turnover.