External users cannot add reviewers to Pull Requests in Azure DevOps

Question

External users cannot add reviewers to Pull Requests in Azure DevOps

Jerrel den Harder 25

Hello,

We are experiencing an issue with external users in our Azure DevOps Services organization.

We have granted a customer access to one of our Azure DevOps projects using their own Microsoft Entra ID account. Access is provided through an Entra ID Security Group, which is added to our Azure DevOps project.

Environment

Azure DevOps Services (cloud)

Authentication: Microsoft Entra ID

External customer accounts

Permissions are assigned through Entra ID Security Groups

Current configuration

At the organization level, the external users are members of:

Project-Scoped Users

Within the project, they receive all required permissions through an Entra ID Security Group (Contributor-level access). They can:

View repositories

Create branches

Push commits

Create Pull Requests

Complete their normal development workflow

Issue

The only functionality that does not work is adding reviewers to a Pull Request.

When the external user opens the Reviewers field, the identity picker only returns a few Azure DevOps groups (for example, "Readers" and "Release Administrators"). It does not return any individual users, even when searching by name.

As a result, they are unable to add reviewers to a Pull Request.

Expected behavior

The external user should be able to search for and add project members as reviewers, just like our internal users can.

Additional observations

Internal users using accounts from our own tenant can successfully search for and add reviewers.

Permissions are granted through Entra ID Security Groups only; we do not assign permissions directly to individual users.

The users we are trying to add as reviewers already have access to the project through Azure DevOps groups.

The issue appears to be related to the Identity Picker rather than repository permissions.

Questions

Is this expected behavior for users who are members of Project-Scoped Users?
Are there any known limitations regarding the Identity Picker for external users?
Is there a configuration or policy that allows external users to search for and add project members as Pull Request reviewers without granting broader organization visibility?
Is this a known issue with Azure DevOps Services?

Any guidance would be greatly appreciated.

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-07-07T05:34:48.38+00:00
Hey Jerrel — thanks for the detailed repro. Based on the provided docs, the behavior you’re seeing likely comes down to who Azure DevOps allows the identity picker to return/search for when users are scoped with Project-Scoped Users and/or when the identity lookup is restricted.

What the docs say about adding reviewers

To add reviewers on a PR (in the web UI), Azure DevOps has you use Reviewers → “Search users and groups to add as reviewers”. You can add matching users/groups from the dropdown and then select them as optional/required reviewers.

Also, Azure DevOps notes that if the user/group you want to review your PR isn’t a member of your project, you must add them to the project before you can add them as reviewers. (So reviewer visibility is tied to project membership.)

Related permission/prerequisite notes

For PR review/create and general PR participation, the docs state that a user must be at least a Basic project member (and for contributions, typically Readers / Contributors roles—depending on the action).

They do not specifically document a scenario where external users (via Entra ID guests) who can create PRs are blocked from searching/adding reviewers due to identity-picker limitations. The only identity-picker-related restriction mentioned in the provided materials is about Entra guest search behavior generally, not PR reviewer search specifically:

There’s an FAQ note indicating Entra guests can’t search Microsoft Entra ID in the manner required by Azure DevOps for some add-user / identity lookup experiences.

Additionally, it’s mentioned that changes to Entra group membership can take up to ~1 hour to show up in Azure DevOps, and the user can “re-evaluate permissions” to refresh.

What this implies for your case

Given your observations:

External users can create PRs and complete the workflow

Only the Reviewers identity picker doesn’t return individual users (only a few Azure DevOps groups)

Internal users from your tenant work correctly

…this strongly suggests the issue is not repository/branch permissions, but rather identity lookup/reviewer search behavior in the web UI for those external identities.

Practical checks you can suggest (from provided docs)

Confirm the reviewer candidates are actually project members (not just have access indirectly). Azure DevOps explicitly says you must add the target user/group to the project before adding them as reviewers.

Ensure Entra group membership changes are refreshed for the external reviewer. If the “external reviewer” accounts were recently added to groups, allow time (~1 hour) or ask them to trigger a permissions refresh via User settings → Permissions → Re-evaluate permissions.

Check whether the external accounts are treated as Entra guests and hit guest lookup limitations. The provided troubleshooting guide calls out a known limitation around Entra guest search behavior in Azure DevOps identity scenarios. While the doc isn’t PR-specific, it aligns with “identity picker returns only limited results.”

Direct answers to your questions (using only provided info)

Is this expected for users in Project-Scoped Users? The provided docs don’t explicitly confirm this as expected behavior for Project-Scoped Users specifically, so we can’t say that it’s “by design” based on the provided documentation alone.

Known limitations regarding the Identity Picker for external users? The provided docs reference limitations for Entra guest search/identity lookup patterns required by Azure DevOps, and also mention permission refresh timing. This is consistent with your symptom, but again the docs don’t explicitly call out “PR reviewer identity picker” as the affected feature.

Config/policy to allow external users to search/add project members as PR reviewers without broader org visibility? The provided documentation doesn’t describe such a specific configuration/policy for PR reviewer search visibility.

Known issue with Azure DevOps Services? The provided materials don’t mention a specific known Azure DevOps Services issue for PR reviewer search not returning users for external identities.

Follow-up questions for you (to pinpoint the root cause)

Are the external customer users Entra guests in your tenant, or are they external members (B2B vs direct membership)?

Are the “reviewer candidates” you’re trying to add directly members of the Azure DevOps project (via Entra group-to-project membership), or do they only have access through additional nesting (group-of-groups / inherited access)?

When did you add the external users and/or reviewer candidates to the Entra group(s) that control project access—was it within the last hour?

Can the external users view PR reviewers on an existing PR (if reviewers are already set by an internal user), or does the identity picker only fail at search-time?

Are you using the web portal identity picker only, or also attempting via Azure DevOps CLI / alternative UI flows?

References (all relevant documentation provided)

Create pull requests (Add reviewers to a pull request – Browser): https://learn.microsoft.com/azure/devops/repos/git/pull-requests?view=azure-devops&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#add-reviewers-to-a-pull-request

Create pull requests (Azure DevOps CLI reviewer options): https://learn.microsoft.com/azure/devops/repos/git/pull-requests?view=azure-devops&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#add-reviewers-to-a-pull-request

About pull requests (Permissions and prerequisites): https://learn.microsoft.com/azure/devops/repos/git/about-pull-requests?view=azure-devops&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#permissions-and-prerequisites

Review pull requests (Prerequisites): https://learn.microsoft.com/azure/devops/repos/git/review-pull-requests?view=azure-devops&wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#prerequisites
Jerrel den Harder 25 Reputation points

2026-07-07T06:21:03.9033333+00:00
Thanks for the compehensive answer, Rukmini.

Here are the answers to your question:

Are the external customer users Entra guests in your tenant, or are they external members (B2B vs direct membership)? They are Entra guests in our tenant.

Are the “reviewer candidates” you’re trying to add directly members of the Azure DevOps project (via Entra group-to-project membership), or do they only have access through additional nesting (group-of-groups / inherited access)? They are directly members of the Azure DevOps project via Entra group-to-project membership.

When did you add the external users and/or reviewer candidates to the Entra group(s) that control project access—was it within the last hour? No, last week.

Can the external users view PR reviewers on an existing PR (if reviewers are already set by an internal user), or does the identity picker only fail at search-time? They can view PR reviewers. However cannot delete or add the same reviewer.

Are you using the web portal identity picker only, or also attempting via Azure DevOps CLI / alternative UI flows? We only use the web portal identity picker.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-07-07T08:38:05.34+00:00

Hello @Jerrel den Harder

We will check internally and get back to you!

Answer accepted by question author

0 additional answers

Your answer

Jerrel den Harder 25 Reputation points

2026-07-07T06:21:03.9033333+00:00

Thanks for the compehensive answer, Rukmini.

Here are the answers to your question:

Are the external customer users Entra guests in your tenant, or are they external members (B2B vs direct membership)? They are Entra guests in our tenant.

Are the “reviewer candidates” you’re trying to add directly members of the Azure DevOps project (via Entra group-to-project membership), or do they only have access through additional nesting (group-of-groups / inherited access)? They are directly members of the Azure DevOps project via Entra group-to-project membership.

When did you add the external users and/or reviewer candidates to the Entra group(s) that control project access—was it within the last hour? No, last week.

Can the external users view PR reviewers on an existing PR (if reviewers are already set by an internal user), or does the identity picker only fail at search-time? They can view PR reviewers. However cannot delete or add the same reviewer.

Are you using the web portal identity picker only, or also attempting via Azure DevOps CLI / alternative UI flows? We only use the web portal identity picker.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-07-07T08:38:05.34+00:00

Hello @Jerrel den Harder

We will check internally and get back to you!

Answer 1

Alex Burlachenko 25,285 MVP Volunteer Moderator

Hi Jerrel den Harder& thx for join me here at Q&A portal,

an Azure DevOps identity visibility issue, not a Git permission issue. Since they can create branches, push, and open PRs, repo permissions are probably fine. The broken part is the identity picker. Project-Scoped Users is very likely involved here. That group intentionally limits what users can see outside their project, and external users often hit weird identity lookup limits bc of that. Classic Azure DevOps: permissions say yes, identity picker says 'never heard of them' :))))))).

try to add one affected external user directly to the project team or Contributors group, not only through an Entra security group. See if Limit user visibility and collaboration to specific projects is enabled at org level. Try adding the reviewer by email / unique identity instead of display name. Look the reviewer has already signed in to the Azure DevOps org at least once. If direct project membership fixes it, then the issue is the combination of external users + project-scoped visibility + Entra group-based assignment. If it still fails, I’d raise it with Azure DevOps support, bc the identity picker behavior is service-side.

rgds,

Alex &

pls if my answer was helpfull mark it as an answer & follow me here and at my blog https://ctrlaltdel.blog/

Jerrel den Harder 25 Reputation points

2026-07-07T09:41:25.5+00:00

Hi @Alex Burlachenko ,

Thanks for the suggestions!

I added everyone individually to the project as well as to the Project-Scoped Users group. After doing that, they were able to add other reviewers successfully.

It looks like the identity visibility was indeed the issue. Thanks for pointing me in the right direction!

Regards, Jerrel
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-07-07T10:57:34.77+00:00

Jerrel den Harder u are welcome any time )

rgds,

Alex

External users cannot add reviewers to Pull Requests in Azure DevOps

Environment

Current configuration

Issue

Expected behavior

Additional observations

Questions

What the docs say about adding reviewers

Related permission/prerequisite notes

What this implies for your case

Practical checks you can suggest (from provided docs)

Direct answers to your questions (using only provided info)

Follow-up questions for you (to pinpoint the root cause)

References (all relevant documentation provided)

0 additional answers

Your answer