Azure DevOps

Declaratively manage Azure DevOps projects, repositories, artifact feeds, service connections and pipelines from Bicep.

Community Maintained

Version	0.1.102
Artifact	br:azuredevopsbicep.azurecr.io/extensions/azuredevops:0.1.102
Source	github.com/johnlokerse/azure-devops-bicep-local-deploy
Publisher	johnlokerse
Licence	MIT
Category	DevOps

Installation

Register the extension in bicepconfig.json:

{
  "experimentalFeaturesEnabled": {
    "localDeploy": true,
    "ociEnabled": true
  },
  "implicitExtensions": [],
  "extensions": {
    "AzureDevOps": "br:azuredevopsbicep.azurecr.io/extensions/azuredevops:0.1.102"
  }
}

Then reference it from your Bicep file:

extension AzureDevOps

Configuration

Configuration is supplied using extension AzureDevOps with { ... }.

Property	Type	Attributes	Description
accessToken	string		Personal Access Token (PAT) for Azure DevOps with appropriate scopes. If omitted, environment variable AZDO_PAT is used.

Overview

The extension calls the Azure DevOps REST API from a local deployment, so an organisation can be described in Bicep alongside the Azure resources it deploys. It needs no extension-level configuration:

extension azuredevops

Resource type	Purpose
AzureDevOpsProject	Create a team project with a process and source control type.
AzureDevOpsRepository	Create a Git repository inside a project.
AzureDevOpsArtifactFeed	Create a project-scoped artifact feed.
AzureDevOpsServiceConnection	Create a federated (workload identity) service connection.
AzureDevOpsPermission	Assign an Entra ID group to a project role.
AzureDevOpsExtension	Install a Marketplace extension into the organisation.
AzureDevOpsWorkItem	Create or update a work item.

Authentication

Two authentication methods are supported:

Method	When to use
Workload identity federation	Preferred. Microsoft Entra access tokens are acquired for the signed-in identity, so no token is stored in the template.
Personal access token (PAT)	Fallback. Pass the token through a @secure() parameter and set pat on each resource.

When running inside an Azure Pipeline, make sure the service principal behind the service connection has the required permissions in the target organisation.

Example

targetScope = 'local'

extension azuredevops

param organization string
param projectName string
param repositoryName string

resource project 'AzureDevOpsProject' = {
  name: projectName
  organization: organization
  visibility: 'Private'
  processName: 'Agile'
  sourceControlType: 'Git'
}

resource repository 'AzureDevOpsRepository' = {
  name: repositoryName
  organization: organization
  project: project.name
}

output projectId string = project.projectId
output repositoryRemoteUrl string = repository.remoteUrl

Notes

• organization is the short organisation slug, not the full https://dev.azure.com/... URL.
• The extension is experimental and tracks the preview local-deploy feature of the Bicep CLI. Treat it as a sample rather than a supported product.
• Deleting a project through this extension deletes everything inside it. Review the plan output before confirming a deployment that removes resources.

Samples

2 example Bicep files are available under Samples.

Resource types

This extension exposes 8 resource types, documented under Reference.

Reference generated from azuredevopsbicep.azurecr.io/extensions/azuredevops:0.1.102 on 2026-08-24.