Backstage External Integrations

Backstage external integrations

Configure provider access independently from Backstage user sign-in and load only the modules needed for the requested capability.

When to invoke

• "Connect Backstage to GitHub with a GitHub App."
• "Discover catalog entities or publish templates in Azure DevOps."
• "Show Azure Pipelines and pull requests in catalog entities."
• "Add ServiceNow incidents or scaffolder actions."

Provider references

• Read GitHub integration for app credentials, discovery, events, and scaffolder permissions.
• Read Azure and Azure DevOps integration for integrations, catalog discovery, events, templates, and the active community CI/CD plugin.
• Read ServiceNow integration for the active community incident and scaffolder packages.

Procedure

1. Confirm target Backstage version, provider host, organizations, projects, and requested capabilities.
2. Keep provider technical credentials separate from GitHub or Microsoft sign-in configuration.
3. Prefer app, service principal, or managed identity credentials over long-lived personal tokens when supported.
4. Install only the catalog, events, scaffolder, frontend, backend, or processor packages needed.
5. Register modules through the new backend system and frontend feature discovery or explicit modules.
6. Store credentials externally and document minimum scopes, expiration, rotation, and owner.
7. Configure bounded discovery filters, schedules, webhook validation, entity annotations, and permission policy.
8. Test provider connectivity, one representative entity, negative authorization, rate limits, webhook authenticity, and failure recovery.

Output template

## Backstage integration result

**Provider:** GitHub | Azure DevOps | ServiceNow

| Capability | Package or module | Credential | Scope | Validation |
| --- | --- | --- | --- | --- |

### External values
- `<ENV_NAME>`: <purpose only>

Quality gate

• Technical integration and user sign-in credentials are separate.
• Only required provider modules are installed.
• Credentials are least-privilege, externalized, owned, and rotatable.
• Discovery and event inputs are bounded and authenticated.
• Entity annotations and provider references are valid.
• Positive, denied, throttled, and unavailable-provider paths are tested.