# AI code review for Azure DevOps pull requests

MergeHarbor reviews Azure Repos pull requests with the context of your whole codebase, posts verified findings as threads on the changed lines, and reports a status you can require in a branch policy. It works with Azure DevOps Services and Azure DevOps Server 2020 or later.

[Start free trial](https://app.mergeharbor.com/signup) [Azure DevOps setup guide](https://mergeharbor.com/docs/azure-devops)

14 days of the Team plan, no card needed.

.mergeharbor.yml

```
review:
  trigger: pushes
  status_check:
    enabled: true
    fail_on_severity: critical
  merge_gate:
    enabled: true
    mode: enforce
    preset: standard
```

## What MergeHarbor does on Azure DevOps Services and Server

Threads on the changed lines

Findings are posted as pull request threads on the lines they are about, plus a summary of the change and what was found.

A status for branch policies

Each review reports a pull request status named mergeharbor/review. Add it under Status checks in a branch policy to require a passing review before completion. The merge gate reports mergeharbor/merge-gate.

Learns from how you resolve threads

Liking a MergeHarbor comment, or resolving its thread as Fixed or Won't fix, tells MergeHarbor what your team acts on.

Mentions and commands

Ask @mergeharbor a question in a pull request comment, or run a command such as @mergeharbor review deep. A comment that starts with mergeharbor review, without the @, is a command too.

Service hooks registered for you

MergeHarbor subscribes to pull request created and updated, pull request comments and pushes for the repositories you enable, and keeps one set of service hooks per repository.

Codebase-aware and verified

Each repository is indexed so the reviewer can follow callers and read related code, and every finding is checked by a second pass before it is posted.

## Connect Azure DevOps

1.  ### Azure DevOps Services

    Choose Azure DevOps Services and connect with Microsoft Entra ID, optionally limited to one organization URL. Your organization must allow third-party application access via OAuth. A personal access token works too.

2.  ### Azure DevOps Server

    Choose Azure DevOps Server, enter your collection URL and paste a personal access token for a service account. The server must be reachable from MergeHarbor.

3.  ### Require the status

    Enable repositories, open a pull request, then add mergeharbor/review or mergeharbor/merge-gate to a branch policy when you want it to block completion.

[Read the full azure DevOps setup guide](https://mergeharbor.com/docs/azure-devops)

## Personal access token scopes

<table class="w-full text-left text-sm" data-astro-cid-iw4wudoa=""><tbody class="divide-y divide-line" data-astro-cid-iw4wudoa=""><tr data-astro-cid-iw4wudoa=""><th scope="row" class="w-1/3 p-4 align-top font-medium text-ink" data-astro-cid-iw4wudoa="">Code</th><td class="p-4 leading-relaxed text-muted" data-astro-cid-iw4wudoa="">Read &amp; write</td></tr><tr data-astro-cid-iw4wudoa=""><th scope="row" class="w-1/3 p-4 align-top font-medium text-ink" data-astro-cid-iw4wudoa="">Code (Status)</th><td class="p-4 leading-relaxed text-muted" data-astro-cid-iw4wudoa="">To report the pull request status</td></tr><tr data-astro-cid-iw4wudoa=""><th scope="row" class="w-1/3 p-4 align-top font-medium text-ink" data-astro-cid-iw4wudoa="">Service Hooks</th><td class="p-4 leading-relaxed text-muted" data-astro-cid-iw4wudoa="">Read &amp; write, to register the subscriptions</td></tr><tr data-astro-cid-iw4wudoa=""><th scope="row" class="w-1/3 p-4 align-top font-medium text-ink" data-astro-cid-iw4wudoa="">Project and Team</th><td class="p-4 leading-relaxed text-muted" data-astro-cid-iw4wudoa="">Read</td></tr><tr data-astro-cid-iw4wudoa=""><th scope="row" class="w-1/3 p-4 align-top font-medium text-ink" data-astro-cid-iw4wudoa="">Account permissions</th><td class="p-4 leading-relaxed text-muted" data-astro-cid-iw4wudoa="">Contribute to pull requests and edit service hook subscriptions in each project; project administrators have both</td></tr></tbody></table>

Documentation: [Azure DevOps Services and Server](https://mergeharbor.com/docs/azure-devops) [Azure Boards](https://mergeharbor.com/docs/azure-boards) [Merge gate](https://mergeharbor.com/docs/merge-gate) [Code host permissions](https://mergeharbor.com/docs/permissions) [Configure reviews](https://mergeharbor.com/docs/configuration)

## Other code hosts

-   [GitLab and GitLab Self-Managed](https://mergeharbor.com/ai-code-review/gitlab)
-   [Bitbucket Cloud and Bitbucket Data Center](https://mergeharbor.com/ai-code-review/bitbucket)
-   [GitHub and GitHub Enterprise Server](https://mergeharbor.com/ai-code-review/github)
-   [Gitea and Forgejo](https://mergeharbor.com/ai-code-review/gitea)
-   [Perforce Helix Core and Helix Swarm](https://mergeharbor.com/ai-code-review/perforce)
-   [All integrations](https://mergeharbor.com/integrations)

Running your code host on a private network? See [self-hosted AI code review](https://mergeharbor.com/ai-code-review/self-hosted).

## Further reading

[Guide · 8 min read Merge gates: safe-to-merge checks for pull requests What a merge gate is, how it turns findings, tests, risk and approvals into one safe-to-merge verdict, and how to roll one out on each code host. Read the guide](https://mergeharbor.com/guides/merge-gates) [Guide · 9 min read How AI code review works, step by step What happens between opening a pull request and the first AI review comment, from the webhook and the code index to verification, posting and learning. Read the guide](https://mergeharbor.com/guides/how-ai-code-review-works)

## Frequently asked questions

Which versions of Azure DevOps Server are supported?

Azure DevOps Server 2020 or later, connected with a personal access token and your collection URL. Servers on a private network must be reachable from MergeHarbor; with a self-hosted MergeHarbor deployment, your operator allows private addresses.

How do we make the review required?

Add the mergeharbor/review status to a branch policy under Status checks to require a passing review before completion, or require mergeharbor/merge-gate to use the merge gate's single verdict instead.

The Entra ID connection failed. What now?

MergeHarbor returns you to the page you started from and says why: the Microsoft account has no Azure DevOps profile, no organization was found for it, or it cannot open the organization. Each message says what to do, and admins can see Azure DevOps' own answer in the audit log.

Is Azure DevOps support generally available?

On Azure DevOps Services and Server, reviews, the status check, auto-approve, description updates, commands and reactions as feedback are supported.

Does MergeHarbor read Azure Boards work items?

Yes, with the Azure Boards connection. When a pull request mentions a work item, MergeHarbor reads it and checks the change against its acceptance criteria. The same connection can comment on linked work items and turn findings into work items.

How do we try it?

Sign up and connect a code host. Every new organization gets the Team plan free for 14 days with no card, including the Deep review tier and the merge gate. If no one subscribes, reviews pause when the trial ends and nothing is deleted.

Have another question? [Ask our support team](https://mergeharbor.com/contact?topic=support)

## Add AI review to Azure Repos

Connect Azure DevOps Services or Server and enable a few repositories. Reviews start on the next pull request.

[Start free trial](https://app.mergeharbor.com/signup) [Book a demo](https://mergeharbor.com/contact?topic=sales&source=demo)