#Enable Backup for Azure DevOps

To back up the Azure DevOps, you can choose to create a service app, or use a custom Azure app with Azure DevOps API user_impersonation permission. For details on creating a custom Azure app in your tenant, refer to .

Complete the steps below:

1. Before you enable the backup service for Azure DevOps, go to AvePoint Online Services to configure a service app profile for that Microsoft 365 tenant. For detailed instructions on creating a service app profile, refer to Create a Service App and Grant Consent.

2. After the service app is ready, go to the Backup page of the Cloud Backup for IaaS + PaaS to configure the backup scope for the Azure DevOps. Note that if you have multiple tenants to protect, you must create a service app for each of them.

   For details on configuring the backup scope, refer to Create a New Backup Scope for Azure DevOps.

   For details on the support list, refer to Azure DevOps.

   *Note: Before you back up your organizations in Cloud Backup for IaaS + PaaS, you must first log into your organizations with the account for which the app profile was configured.

#Create a Service App and Grant Consent

For the backup and restore services of Azure DevOps, you must create a service app to connect to your tenant and grant consent for the permissions this app requests.

To create an app profile and grant consent, a Project Collection Administrator of the Azure DevOps organization account is required, and your tenant must have previously created or connected to an organization in Azure DevOps. For details on how to add users to the Project Collection Administrator group, refer to the Microsoft article: .

Follow the steps below to create the service app:

1. On the Management > App management page, click Create on the action bar.

2. In the Select services step, select Cloud Backup for IaaS + PaaS.

3. In the Choose setup method step, select Modern mode and click Next.

4. In the Consent to apps step, click Consent next to the Cloud Backup for Azure DevOps.

5. On the Microsoft 365 sign-in page, sign in with a Microsoft 365 Global Administrator account.

6. On the Permissions required page, review the permissions required and click Accept to continue. For the API permissions that this app requests, refer to Default Permissions Granted to the Service App.

7. The app profile you created will be displayed on the App management page, and the Cloud Backup for Azure DevOps app will be added to your Microsoft Entra admin center > enterprise applications.

#Default Permissions Granted to the Service App

If you want to protect Azure DevOps, you can choose to create a Cloud Backup for Azure DevOps service app profile or create a custom Azure app profile with delegated permissions through AvePoint Online Services > Management > App management page.

1. The following API permissions will be automatically added to the service app with consent from your Global administrator account. You can also choose the specific permissions to grant your custom Azure app for the services or data types that you want to protect upon the usage purpose. Currently, the required permissions don’t have any alternative permissions.

API	Permissions	Type	Why You Need	Permission Category
Azure DevOps	user_impersonation(Have full access to Visual Studio Team Services REST APIs)	Delegated	Have full access to Visual Studio Team Services REST APIs.	Azure DevOps
Microsoft Graph	User.Read.All(Read all user’s full profile)	Delegated	Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.	Sign into AvePoint Online Services with Microsoft 365 accounts.