---
title: Azure Repos (cloud)
slug: docs/azure-repos-cloud
description: Learn how to configure Azure Repos for scanning using a personal access token (PAT). Discover the various configuration options available, including the ability to specify organizations, projects, and repositories.
icon: {"faIcon":"fa-brands fa-microsoft"}
docTags: 
createdAt: 2024-04-17T16:33:02.620Z
---

# Azure Repos (cloud)

:::BlockQuote
**Edition:** Enterprise only
:::

The Azure Repos integration scans repositories in Azure DevOps for credentials and other sensitive data.

## Configuration

The Azure Repos integration can be configured in TruffleHog under **Integrations**, or via a local configuration file (below).

### Web configuration

Configure this integration from the **Integrations** page in TruffleHog. You'll need a personal access token (PAT) from Azure DevOps with the **Code (read)** scope.

### Local configuration

**Create a personal access token**

1. In Azure DevOps, click the **User Settings** icon in the top right next to your profile picture.
2. Click **Personal access tokens**.
3. Click **New Token**.
4. Name the token, select an organization, and choose **Custom defined**. Then select the **Code (read)** scope.
5. Click **Create**.

**Configure scope**

When specifying organizations, projects, and repositories, keep in mind:

- At least one organization is required.
- The hierarchy is organizations > projects > repositories. Projects must belong to specified organizations, and repositories must belong to specified projects.
- Specifying only organizations scans all their projects. Specifying only projects scans all their repositories.
- Ignore filters always override include filters, for both projects and repositories.

**Access token**

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.AzureRepos
      organizations:
        \- trufflesecurity
      ignoreProjects:
        \- Project2
      ignoreRepos:
        \- https\://dev.azure.com/trufflesecurity/IgnoreRepo
      includeForks: false
      skipBinaries: true
      token: XXXXXXXXXXXXXXXXXXXXXXXXXX
    name: Azure Repos
    scanPeriod: 12h
    type: SOURCE\_TYPE\_AZURE\_REPOS
    verify: true
:::

## Configuration options

| Field           | Type    | Required | Description                                                       |
| --------------- | ------- | -------- | ----------------------------------------------------------------- |
| organizations   | list    | Yes      | List of organizations to scan. At least one is required.          |
| endpoint        | string  | No       | Endpoint URL for Azure Repos.                                     |
| projects        | list    | No       | List of projects to scan.                                         |
| includeProjects | list    | No       | Projects to include in scanning.                                  |
| ignoreProjects  | list    | No       | Projects to skip during scanning.                                 |
| repositories    | list    | No       | Explicit list of repositories to scan. Omit to enumerate instead. |
| includeRepos    | list    | No       | Repositories to include in scanning.                              |
| ignoreRepos     | list    | No       | Repositories to skip during scanning.                             |
| includeForks    | boolean | No       | Include forked repositories.                                      |
| skipBinaries    | boolean | No       | Skip binary files.                                                |
| skipArchives    | boolean | No       | Skip archive files.                                               |

## Capabilities

| Feature                    | Supported |
| -------------------------- | --------- |
| Scan archive files         | ✅         |
| Scan archived repositories | ✅         |
| Scan base64-encoded data   | ✅         |
| Scan binaries              | ✅         |
| History                    | ✅         |
| Include / exclude filters  | ✅         |
| Pre-commit                 | ✅         |
| Auto-resume                | ✅         |

## Notes

- TruffleHog does not scan diffs larger than 1 GB.
- Only cloud-hosted Azure Repos are supported. Self-hosted Azure DevOps Server is not scannable.