Skip to main content
A service account is a dedicated user, such as codeant-ai-bot, whose personal access token CodeAnt uses to read repositories and post reviews. Use it when you want automated activity attributed to a separate account and managed independently of a developer’s membership.
To connect Azure DevOps Services without a user PAT, use Microsoft Entra workload identity.

​
Before you begin

  • A dedicated Microsoft Entra user with a company email address. Ask your identity administrator to create it if it does not exist.
  • An Azure DevOps administrator who can add users and assign project access.
  • Permission for the dedicated user to create PATs under your organization’s policy.
  • The projects and repositories CodeAnt should access.

​
Create the account and token

1

Add the dedicated user to Azure DevOps

Open the Azure DevOps organization and go to Organization settings → Users → Add users.Enter the dedicated user’s email address. Set Access level to Basic, select the projects CodeAnt should access, and add the user. Follow Microsoft’s user management guide if you need help assigning access.
2

Check repository permissions

In each selected project, open Project settings → Repositories → Security and select the dedicated user. Confirm that the account has Read and Contribute to pull requests access, with no inherited or explicit Deny blocking them.Contribute to pull requests allows review activity. Contribute is a separate permission for pushing code; grant it only if you want CodeAnt to perform code writes. See Microsoft’s repository permission definitions.
3

Create the PAT as the dedicated user

Sign in to Azure DevOps as the dedicated user. Open User settings → Personal access tokens and select + New Token.Name the token CodeAnt AI, select the intended organization, and choose an expiry date permitted by your policy. Select these scopes:Code and Pull Request Threads are the scopes for scans and reviews. Add Build for DORA metrics and Work Items for work item data and Azure DevOps ticket creation.Select Create and copy the token before leaving the page. The PAT inherits the dedicated user’s access; scopes do not grant access to projects the user cannot reach.

​
Connect and verify the account

  1. Use the dedicated user’s PAT in the CodeAnt organization connection.
  2. Use the same PAT in both subscriptions from the pull request review setup.
  3. Confirm that an expected repository appears in CodeAnt.
  4. Open a new PR in that repository and check that CodeAnt’s review comments are attributed to the dedicated account.
Existing comments keep their original author when you change credentials. Verify attribution with a new review after updating both service hooks and the CodeAnt connection.

​
Replace the token before it expires

  1. Sign in as the dedicated user and create a new PAT with the same scopes.
  2. Update the saved token in CodeAnt and in both CodeAnt service hook subscriptions.
  3. Request a review and confirm that it succeeds.
  4. Revoke the old PAT in Azure DevOps.
Keep the dedicated user’s project access limited to the repositories you use, and review it when projects are archived or removed from the integration.

​
Troubleshooting

Check its Basic access level, project membership, and repository Read permission. Check inherited Deny settings as well as the permissions assigned directly to the user.
Confirm Contribute to pull requests access and the PAT’s Pull Request Threads: Read & write scope. Check that both service hook subscriptions use this PAT. If review posting still fails, contact CodeAnt support with the project and PR URL. Do not include the token.
Confirm that the PAT was created while signed in as the dedicated user, then update both service hooks and the saved CodeAnt connection. Open a new PR to verify the author; existing comments do not change attribution.

​
Next steps

Connect your organization

Save the dedicated user’s PAT and verify repository access.

Enable pull request reviews

Configure the project service hooks with the dedicated user’s PAT.