Azure DevOps OAuth: How to support both MSA and Entra users using OAuth

Gourav Jangra 25 Reputation points
2026-06-08T16:39:29.31+00:00

Requirement - We are building a web-based onboarding portal that supports OAuth-based authentication for multiple SCM providers (e.g., GitHub, GitLab, Bitbucket). As part of this, we want to extend the same authentication experience to Azure DevOps.

However, we understand that Azure DevOps OAuth applications are deprecated, and new app registrations are no longer supported, with guidance to use Microsoft Entra OAuth instead.

Accordingly, we attempted to implement Azure DevOps authentication using Microsoft Entra OAuth along with On-Behalf-Of (OBO) flow.

We referred to the official Microsoft documentation:

From the documentation, we understand the following limitations:

  • Microsoft Entra OAuth apps do not natively support Microsoft account (MSA) users for Azure DevOps resources.
  • For scenarios requiring both Entra ID (work/school) and MSA users, legacy Azure DevOps OAuth apps are recommended.
  • Native support for MSA via Entra OAuth is still under development.

Our current app registration is configured with:

  • signInAudience = AzureADandPersonalMicrosoftAccount

Questions:

  1. With current GA capabilities, is there any supported Entra OAuth flow for Azure DevOps that works for both MSA and Entra users?
  2. If Azure DevOps OAuth app creation is not available for new setups in my tenant, what is the officially supported path today?
  3. Is there any public ETA or preview for native MSA support in Entra OAuth for Azure DevOps?
Azure DevOps
Answer accepted by question author
Pravallika KV 18,855 Reputation points Microsoft External Staff Moderator
2026-06-08T16:53:20.7966667+00:00

Hi @Gourav Jangra ,

Thanks for reaching out to Microsoft Q&A.

Based on the current Microsoft guidance, your understanding is correct: there is still a gap between Azure DevOps' new Microsoft Entra OAuth model and support for MSA.

  1. Is there a supported Microsoft Entra OAuth flow that works for both MSA and Entra users (GA)?

Based on the provided documentation: Entra OAuth apps don't natively support Microsoft account (MSA) users for Azure DevOps resources. The guidance explicitly calls out that if you need both MSA and Entra users, then Azure DevOps OAuth apps remain the best option (i.e., the legacy Azure DevOps OAuth platform), while Microsoft works on native MSA support “through Microsoft Entra OAuth”.

So, with current capabilities there isn't a “supported Entra OAuth OBO flow” that covers both MSA and work/school (Entra) users for Azure DevOps resources.

  1. If new Azure DevOps OAuth app creation isn’t available in a tenant, what’s the officially supported path today?
  • New registrations of Azure DevOps OAuth apps are no longer supported (stated as “no new Azure DevOps OAuth apps beginning April 2025”).
  • The recommended direction for new builds is to use Microsoft Entra OAuth (and register an Entra application).
  • However, for immediate scenarios that must support MSA + Entra together, the docs still say Azure DevOps OAuth apps remain the best option (with native MSA support through Entra OAuth still in progress).

So the “officially supported path today” depends on which requirement is hard:

  • If you can support Entra users only, then the recommended path is: Microsoft Entra OAuth (user delegation / OBO).
  • If you must support MSA + Entra users in the same onboarding/auth experience, the docs indicate you may be blocked by the current limitation of Entra OAuth for MSA.

Also noted in the OAuth documentation: existing Azure DevOps OAuth apps will continue working until the platform's official retirement in 2026, but new OAuth app registrations aren't being accepted.

  1. Is there public ETA/preview for native MSA support in Entra OAuth for Azure DevOps?

AFAIK, no public ETA has been announced yet. Microsoft has stated that native MSA support is under development, but there is currently no published timeline or public preview program.

Hope this helps!

If the resolution was helpful, kindly take a moment to click on User's imageand click on Yes for was this answer helpful. And, if you have any further query do let us know.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-06-08T16:39:50.6933333+00:00
    1. There is currently no Microsoft Entra OAuth flow for Azure DevOps that supports both Entra ID and MSA users in a single, native experience. The documented guidance is:
      • “Microsoft Entra apps don't natively support Microsoft account (MSA) users for the Azure DevOps resource. If you're building an app that must cater to MSA users or support both Microsoft Entra and MSA users, Azure DevOps OAuth apps remain your best option. Microsoft is currently working on native support for MSA users through Microsoft Entra OAuth.”
      So with current GA capabilities, Entra OAuth works for Entra ID-backed Azure DevOps users only. MSA-backed Azure DevOps users cannot be onboarded to Azure DevOps via Entra OAuth today.
    2. For new setups where Azure DevOps OAuth app creation is no longer available, the officially supported path is:
      • Use Microsoft Entra ID OAuth for all Azure DevOps users that sign in with Entra ID.
      • There is no new, supported replacement that allows registering a new Azure DevOps OAuth app for MSA users once the deprecation cutoff is reached.
      The current platform guidance is:
      • “Use Microsoft Entra ID OAuth for new applications that integrate with Azure DevOps Services.”
      • “Azure DevOps OAuth is deprecated and scheduled for removal in 2026. This documentation is for existing Azure DevOps OAuth apps only. New app registrations are no longer accepted as of April 2025.”
      In other words:
      • Existing Azure DevOps OAuth apps can continue to serve both Entra and MSA users until removal in 2026.
      • New applications must use Microsoft Entra OAuth and therefore can only support Entra-backed Azure DevOps users today.
    3. There is no public ETA or public preview date in the documentation for native MSA support in Microsoft Entra OAuth for Azure DevOps. The only statement is that “Microsoft is currently working on native support for MSA users through Microsoft Entra OAuth,” without any timeline or preview details. No additional schedule or roadmap information is provided in the referenced content.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.