Reference A: Subscribed events and permission scopes

This reference lists the Azure DevOps authorization scopes the Cortex Cloud application requires. The same scopes apply to every integration type: Microsoft Entra ID (User), Service Principal, and Personal Access Token (PAT).

Scope	Description	Permission level
vso.identity	Identity (read).	Read
vso.build	Build (read).	Read
vso.code_write	Code (read and write).	Write
vso.threads_full	Pull-request threads (full read and write).	Write
vso.agentpools	Agent Pools (read).	Read
vso.packaging	Packaging (read).	Read
vso.extension	Extensions (read).	Read
vso.entitlements	Entitlements (read).	Read
vso.release	Release (read).	Read
vso.taskgroups_write	Task Groups (read, create, and manage).	Admin
vso.variablegroups_read	Variable Groups (read).	Read
vso.serviceendpoint	Service Endpoints (read).	Read
vso.project	Project and team (read).	Read
vso.analytics	Analytics (read).	Read
vso.graph	Graph (read).	Read
vso.memberentitlementmanagement	Member Entitlement Management (read).	Read
vso.tokens	Delegated Authorization Tokens.	Admin
vso.auditlog	Audit Log (read).	Read
vso.work_write	Work items (read and write).	Write

Permission-level totals: Read = 14, Write = 3, Admin = 2.

NOTE: How you grant these scopes depends on the integration type. With a Personal Access Token, select all scopes manually during token creation. With Microsoft Entra ID (User) and Service Principal, you do not select scopes individually. You review and consent to the full pre-declared set in a single action.

NOTE: The vso.code_write and vso.build scopes are required for the event-driven architecture. Azure DevOps has no single webhook permission; the ability to create subscriptions derives from these standard scopes. Without them, Cortex Cloud reverts to scheduled (polling) synchronization only.