Reference C: Repository-scope troubleshooting

Integration health is evaluated at two scopes: the instance scope (the Cortex Cloud identity acquires tokens for the tenant and reaches the Azure DevOps organization) and the repository scope (the identity can read code, refs, and metadata for each onboarded repository). An instance can remain Connected while one or more onboarded repositories report a non-connected status, because per-repository access is governed by Azure DevOps project- and repository-level controls that are independent of the org-level admin-consent grant.

The following matrix covers the repository-scope failure modes Cortex Cloud distinguishes when the parent instance is Connected. Each row is mutually exclusive; the platform reports the first matching condition.

Per-repository symptom	Likely cause	User action
Single repository reports Not connected; all other repositories under the same project remain Connected.	The Cortex Cloud identity is not a member of the Project Contributors group for the project that contains the repository. The org-level grant authorizes the tenant boundary; project membership authorizes the repository surface.	Grant the Cortex Cloud application project membership using either path: (a) Organization Settings → Users, select the Cortex Cloud application row, then use Add to projects to add the affected project; or (b) open the project → Project Settings → Permissions → Contributors and add the Cortex Cloud application. No re-consent in Microsoft Entra ID is required.
Single repository reports Not connected; the Azure DevOps repository settings page shows the repository toggle as disabled.	An Azure DevOps project administrator disabled the repository. A disabled repository returns TF401019 (or HTTP 404 on the Git endpoints) for every API caller.	Re-enable the repository in Project Settings → Repositories. The repository returns to Connected on the next scheduled health check, or immediately after Refresh on the Integrations list.
Single repository reports Not connected after previously being Connected; the repository ID resolves to 404 Not Found on Azure DevOps APIs.	The repository was deleted, or renamed in a way that severed the stored repository ID reference. Cortex Cloud pins onboarded repositories by their Azure DevOps repository GUID.	If the deletion was intentional, remove the repository from the integration in **Settings → Data Sources & Integrations → → Edit → Select Repositories**. If the repository should still be tracked, re-create it in Azure DevOps and re-add it to the repository selection (the new GUID is onboarded).
All repositories under a single Azure DevOps project report Not connected; other projects in the same organization remain Connected.	The Azure DevOps project was disabled or deleted. When a project is disabled, every repository inside it returns TF400898 / HTTP 403 regardless of the identity's organization-level access.	Re-enable the project at Organization Settings → Projects, or remove the affected repositories from the repository selection.
Single repository reports Not connected; the repository now appears under a different project than at onboarding time.	The repository was moved to a different Azure DevOps project, and the Cortex Cloud identity does not hold project-scoped permissions on the new project.	Add the Cortex Cloud application to the Contributors group of the new project. Cortex Cloud detects the project move automatically and resumes scans once project membership is restored.
Single repository reports Not connected; the repository visibility changed from Public or Internal to Private.	The repository visibility was tightened to Private with a restricted access list, and the Cortex Cloud identity is not on the access list. Azure DevOps returns HTTP 403 on the Git endpoints even when the identity has the org-level Code (read) scope.	Add the Cortex Cloud application to the repository's access list in **Project Settings → Repositories → → Security**, or move the repository back to Internal if the original sharing model is preferred.
Single repository reports Not connected for webhook-delivered events only; on-demand scans succeed for the same repository.	The Azure DevOps service hook subscription (push, pull-request created, pull-request updated) that Cortex Cloud creates per repository was deleted, paused, or orphaned. Token-based polling is unaffected, but real-time scan-on-event delivery stops.	Open Project Settings → Service hooks, remove any disabled or duplicated Cortex Cloud subscriptions for the repository, then remove and re-add the repository in the integration's repository selection to re-create the subscriptions.

NOTE: All repository-scope conditions resolve without re-running Microsoft Entra ID admin consent. Admin consent governs the tenant-level token boundary; the conditions above govern project- and repository-level access controls inside Azure DevOps.