Configuring Azure Active Directory for Azure DevOps Utopia


One of the goals I have with DevOps Utopia is to make it easy for people to join as a contributor and a reader. This should give people access to both the Azure DevOps project and the Azure portal with the correct permissions.

The way I configured this, is to link both my Azure subscription and my Azure DevOps organization to an Azure Active Directory, create some groups and set the correct permissions. In this blog post I show you how.

Creating the Azure Active Directory

Creating a new Azure Active Directory in the Azure portal is quite simple. Make sure you have an existing Azure subscription (trial, free credits from your Visual Studio subscription or a paid subscription). Just follow these steps and you have a new tenant.

Connecting Azure DevOps to Azure Active Directory

Microsoft has two types of accounts that you can use to create an Azure DevOps organization:

  • Microsoft account such as,
  • Work/school account such as

If you create your Azure DevOps organization with a Microsoft account, your organization is not backed by Azure Active Directory. If you create your organization with a work/school account, the organization gets linked to the AAD tenant automatically.

For Utopia, I created the organization Utopia-Demo with my account. I then connected the organization to my new tenant by going to the organization settings and selecting the Azure Active Directory tab:

Search for AAD in the Azure Portal to create an Azure Active Directory

Make sure to read the detailed steps. Especially when you have existing users and content in your organization you want to make sure you don’t accidentally lock people out.  

Azure permissions

I’ve then created two groups in my AAD:

A Reader and Contributor group for Utopia

Both groups get access to the Azure resources. I have several resource groups that contain the test and production environments of Utopia and other resources such as SonarQube. For every resource group I added Utopia – Contributors and Utopia – Readers:

The different groups get access to the resource groups containing the Utopia deployment

If I now invite a user to one of two groups they get an email inviting them to the Azure Active Directory tenant. After accepting the invitation they can logon to the Azure portal and see the resource groups.

Azure DevOps permissions

In Azure DevOps I’ve used group rules to import the users from the two AAD groups, assign an Access level and add them to a team project.

Here you see that all users in the Utopia – Readers group automatically get a Basic access level and are assigned to the Project Readers group of project Utopia.

Configure Group Rules in Azure DevOps to map to the AAD groups

And that’s it

Inviting people to Utopia is now a one step process and all permissions in both Azure DevOps and Azure are in place.

Now that the basics are done and the first people have joined, I can continue working on adding new DevOps features!

If you’re interested in joining Utopia as a reader feel free to reach out on Twitter or email.