Azure DevOps organization became inaccessible immediately after connecting the organization to Microsoft Entra ID.

Azure DevOps organizations connected to Microsoft Entra ID require that the signed-in identity:

1. Exists in the Azure DevOps organization’s Users list.
2. Matches the Microsoft Entra UPN exactly (no alias, no different account type).
3. Has sufficient access level and project permissions.

A 401/403 on all org/project/repo URLs while the profile API still works is consistent with an identity/entitlement mismatch after Entra connection.

Use the following checks and recovery steps:

1. Verify the identity in the organization
   • Have another Azure DevOps organization administrator (if any still has access) go to:
     • Organization settings → Users.
   • Confirm that the affected user is present and that the identity exactly matches the Microsoft Entra UPN used to sign in (no alias). Azure DevOps does not support sign-in aliases; the exact UPN must be used.
   • If the identity is missing, it must be added back from Microsoft Entra ID.
2. Check for UPN vs alias or account-type issues
   • Ensure sign-in is done with the exact UPN, not an alias (for example, ******@contoso.com instead of ******@contoso.com).
   • If the organization was previously using a different account type (personal Microsoft account vs Microsoft Entra account), the first account type used is what Azure DevOps bound to. If a change is needed, an administrator must remove and re-add the user so the correct account type is established.
3. Confirm permissions at org and project level
   • In Organization settings → Users, verify the user’s access level is at least Basic (not Stakeholder) so that Azure Repos access is allowed.
   • In each project, under Project settings → Repos → Security, ensure the user (or a group containing the user) has at least Read and Contribute permissions on the required repositories.
4. Resolve disconnected identities after Entra connection
   • If some users became disconnected during the Entra connection, use the built-in resolution flow:
     1. In Organization settings, select Microsoft Entra ID.
     2. Select Resolve.
     3. Match the existing Azure DevOps identities to the correct Microsoft Entra identities and complete the wizard.
   • This remaps old identities (for example, from personal email) to the new Entra IDs so that references and ownership are preserved.
5. If ownership or mapping cannot be fixed via UI
   • When the sole owner is locked out and no other admin can correct the mapping, or when the Entra connection caused an unrecoverable mismatch, backend assistance is required.
   • Use the documented support channels for Azure DevOps to request:
     • Organization ownership recovery, or
     • Assistance with Microsoft Entra connection issues (including cases where users are disconnected or mappings cannot be resolved via the portal).

These steps align with the documented behavior that:

• Organizations connected to Microsoft Entra ID require Entra authentication.
• 401 errors commonly result from the identity not being in the organization, UPN/alias mismatch, or insufficient permissions.
• After connecting to Entra, identities can be remapped using the Resolve flow, and support can assist when that is not sufficient.

References:

• Troubleshoot connecting to a project
• Access via Microsoft Entra FAQs
• Access Azure DevOps with Microsoft Entra workload identity
• Convert service connections from the Azure DevOps issuer to the Microsoft Entra issuer
• Lost access to all Repos - Microsoft Q&A
• https://learn.microsoft.com/en-us/answers/questions/ask/?wt.mc_id=pcs_inproduct_azportal_caseask&portal=azure&context=sso&source=azure-portal Unable to access this even after accesses - Microsoft Q&A