Azure DevOps Admin
Shared Workflow Routing
Overview
Azure DevOps administration covers security, governance, integration, and observability. Security namespaces define granular ACL-based permissions for every resource type (repos, pipelines, areas, iterations). Dashboards aggregate project health via configurable widgets. Wikis provide documentation as code. Service hooks enable event-driven integrations with external systems.
Analytics OData provides rich querying across work items, pipelines, and test results for Power BI dashboards and trend analysis. The Azure DevOps CLI (az devops) offers a complete command-line interface. Extensions from the Visual Studio Marketplace add custom functionality.
REST API — Security
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/securitynamespaces?api-version=7.1 |
— |
| GET |
/_apis/accesscontrollists/{namespaceId}?api-version=7.1 |
token, descriptors |
| POST |
/_apis/accesscontrolentries/{namespaceId}?api-version=7.1 |
Body: token, merge, accessControlEntries |
| DELETE |
/_apis/accesscontrolentries/{namespaceId}?api-version=7.1 |
token, descriptors |
Key Security Namespace GUIDs
| Namespace |
GUID |
Token Format |
| Git Repositories |
2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87 |
repoV2/{projectId}/{repoId} |
| Build |
33344d9c-fc72-4d6f-aba5-fa317c3b7be8 |
{projectId} |
| ReleaseManagement |
c788c36e-058b-4f2e-8dac-b15712483ed1 |
{projectId} |
| CSS (Area paths) |
83e28ad4-2d72-4ceb-97b0-c7726d5502c3 |
vstfs:///Classification/Node/{nodeId} |
| Iteration |
bf7bfa03-b2b7-47db-8113-fa2e002cc5b1 |
vstfs:///Classification/Node/{nodeId} |
| ServiceEndpoints |
49b48001-ca20-4adc-8111-5b60c903a50c |
endpoints/{projectId}/{endpointId} |
REST API — Dashboards
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/dashboard/dashboards?api-version=7.1-preview |
— |
| POST |
/_apis/dashboard/dashboards?api-version=7.1-preview |
Body: name, description |
| GET |
/_apis/dashboard/dashboards/{dashboardId}/widgets?api-version=7.1-preview |
— |
| POST |
/_apis/dashboard/dashboards/{dashboardId}/widgets?api-version=7.1-preview |
Body: widget configuration |
REST API — Wikis
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/wiki/wikis?api-version=7.1 |
— |
| POST |
/_apis/wiki/wikis?api-version=7.1 |
Body: name, type (projectWiki / codeWiki) |
| GET |
/_apis/wiki/wikis/{wikiId}/pages?path={path}&api-version=7.1 |
path, includeContent |
| PUT |
/_apis/wiki/wikis/{wikiId}/pages?path={path}&api-version=7.1 |
Body: content; Header: If-Match: {eTag} |
| DELETE |
/_apis/wiki/wikis/{wikiId}/pages?path={path}&api-version=7.1 |
comment |
REST API — Service Hooks
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/hooks/subscriptions?api-version=7.1 |
— |
| POST |
/_apis/hooks/subscriptions?api-version=7.1 |
Body: publisherId, eventType, consumerActionId, consumerInputs |
| GET |
/_apis/hooks/publishers?api-version=7.1 |
— |
| GET |
/_apis/hooks/consumers?api-version=7.1 |
— |
| POST |
/_apis/hooks/testnotifications/{subscriptionId}?api-version=7.1 |
— |
REST API — Extensions
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/extensionmanagement/installedextensions?api-version=7.1-preview |
— |
| POST |
/_apis/extensionmanagement/installedextensions?api-version=7.1-preview |
Body: publisherName, extensionName |
| DELETE |
/_apis/extensionmanagement/installedextensions/{publisher}/{extension}?api-version=7.1-preview |
— |
REST API — Artifacts
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/packaging/feeds?api-version=7.1 |
$top, includeUrls |
| POST |
/_apis/packaging/feeds?api-version=7.1 |
Body: name, upstreamEnabled |
| GET |
/_apis/packaging/feeds/{feedId}/packages?api-version=7.1 |
protocolType, packageNameQuery |
Analytics OData
Endpoint: https://analytics.dev.azure.com/{org}/{project}/_odata/v4.0-preview/
Key entity sets: WorkItems, WorkItemRevisions, PipelineRuns, TestRuns, TestResults, TestResultsDaily.
Query operators: $filter, $select, $expand, $orderby, $top, $apply (for aggregations).
Azure DevOps CLI
# Install
az extension add --name azure-devops
# Configure defaults
az devops configure --defaults organization=https://dev.azure.com/{org} project={project}
# Key command groups
az repos list / create / show
az repos pr create / list / update / complete
az pipelines list / show / run / create
az boards work-item create / show / update
az artifacts universal publish / download
# Escape hatch for any REST API
az devops invoke --area git --resource repositories --api-version 7.1
Best Practices
- Use security namespaces for granular permission control — avoid broad group assignments.
- Configure service hooks for real-time notifications to Teams/Slack channels.
- Create project wikis for living documentation; use code wikis for API docs.
- Use ETag-based concurrency for wiki page updates to prevent lost edits.
- Build custom dashboards per team with sprint burndown, build health, and test trend widgets.
- Use Analytics OData for Power BI dashboards — narrow filters and use
$select for performance.
- Prefer
az devops CLI for scripting over raw REST API calls.
- Review extension permissions before installing — extensions can access project data.
Progressive Disclosure — Reference Files
| Topic |
File |
| API surface map, failure modes, limits, safe-default patterns |
references/operational-knowledge.md |
| Artifact feeds, package types, upstreams, retention, symbols |
references/artifact-feeds.md |
| Security namespaces, token formats, ACL/ACE patterns, permissions |
references/security-namespaces.md |
| Wiki types, page CRUD, ETag concurrency, page analytics |
references/wiki-management.md |
| Service hooks, event types, webhook targets, subscriptions |
references/service-hooks.md |
| Dashboard CRUD, widget types, configuration, custom widgets |
references/dashboards-widgets.md |
| OData endpoints, entity sets, aggregation queries, Power BI |
references/analytics-odata.md |
| az devops CLI, command groups, invoke escape hatch, recipes |
references/devops-cli.md |
| Extension management, marketplace, pipeline decorators, SDK |
references/extensions-marketplace.md |
1---2name: azure-devops-admin3description: Deep expertise in Azure DevOps administration — security namespaces and permissions, dashboards and widgets, wiki management, service hooks and webhooks, Analytics OData, Azure DevOps CLI, extensions and marketplace, and artifact feed governance.4---56# Azure DevOps Admin78## Shared Workflow Routing9- Use the shared workflow spec for deterministic multi-plugin routing: [`workflows/multi-plugin-workflows.md`](../../../workflows/multi-plugin-workflows.md#incident-triage-azure-monitor--azure-functions--azure-devops).1011## Overview1213Azure DevOps administration covers security, governance, integration, and observability. Security namespaces define granular ACL-based permissions for every resource type (repos, pipelines, areas, iterations). Dashboards aggregate project health via configurable widgets. Wikis provide documentation as code. Service hooks enable event-driven integrations with external systems.1415Analytics OData provides rich querying across work items, pipelines, and test results for Power BI dashboards and trend analysis. The Azure DevOps CLI (`az devops`) offers a complete command-line interface. Extensions from the Visual Studio Marketplace add custom functionality.1617## REST API — Security1819| Method | Endpoint | Key Parameters |20|--------|----------|----------------|21| GET | `/_apis/securitynamespaces?api-version=7.1` | — |22| GET | `/_apis/accesscontrollists/{namespaceId}?api-version=7.1` | `token`, `descriptors` |23| POST | `/_apis/accesscontrolentries/{namespaceId}?api-version=7.1` | Body: `token`, `merge`, `accessControlEntries` |24| DELETE | `/_apis/accesscontrolentries/{namespaceId}?api-version=7.1` | `token`, `descriptors` |2526### Key Security Namespace GUIDs2728| Namespace | GUID | Token Format |29|-----------|------|--------------|30| Git Repositories | `2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87` | `repoV2/{projectId}/{repoId}` |31| Build | `33344d9c-fc72-4d6f-aba5-fa317c3b7be8` | `{projectId}` |32| ReleaseManagement | `c788c36e-058b-4f2e-8dac-b15712483ed1` | `{projectId}` |33| CSS (Area paths) | `83e28ad4-2d72-4ceb-97b0-c7726d5502c3` | `vstfs:///Classification/Node/{nodeId}` |34| Iteration | `bf7bfa03-b2b7-47db-8113-fa2e002cc5b1` | `vstfs:///Classification/Node/{nodeId}` |35| ServiceEndpoints | `49b48001-ca20-4adc-8111-5b60c903a50c` | `endpoints/{projectId}/{endpointId}` |3637## REST API — Dashboards3839| Method | Endpoint | Key Parameters |40|--------|----------|----------------|41| GET | `/_apis/dashboard/dashboards?api-version=7.1-preview` | — |42| POST | `/_apis/dashboard/dashboards?api-version=7.1-preview` | Body: `name`, `description` |43| GET | `/_apis/dashboard/dashboards/{dashboardId}/widgets?api-version=7.1-preview` | — |44| POST | `/_apis/dashboard/dashboards/{dashboardId}/widgets?api-version=7.1-preview` | Body: widget configuration |4546## REST API — Wikis4748| Method | Endpoint | Key Parameters |49|--------|----------|----------------|50| GET | `/_apis/wiki/wikis?api-version=7.1` | — |51| POST | `/_apis/wiki/wikis?api-version=7.1` | Body: `name`, `type` (projectWiki / codeWiki) |52| GET | `/_apis/wiki/wikis/{wikiId}/pages?path={path}&api-version=7.1` | `path`, `includeContent` |53| PUT | `/_apis/wiki/wikis/{wikiId}/pages?path={path}&api-version=7.1` | Body: `content`; Header: `If-Match: {eTag}` |54| DELETE | `/_apis/wiki/wikis/{wikiId}/pages?path={path}&api-version=7.1` | `comment` |5556## REST API — Service Hooks5758| Method | Endpoint | Key Parameters |59|--------|----------|----------------|60| GET | `/_apis/hooks/subscriptions?api-version=7.1` | — |61| POST | `/_apis/hooks/subscriptions?api-version=7.1` | Body: `publisherId`, `eventType`, `consumerActionId`, `consumerInputs` |62| GET | `/_apis/hooks/publishers?api-version=7.1` | — |63| GET | `/_apis/hooks/consumers?api-version=7.1` | — |64| POST | `/_apis/hooks/testnotifications/{subscriptionId}?api-version=7.1` | — |6566## REST API — Extensions6768| Method | Endpoint | Key Parameters |69|--------|----------|----------------|70| GET | `/_apis/extensionmanagement/installedextensions?api-version=7.1-preview` | — |71| POST | `/_apis/extensionmanagement/installedextensions?api-version=7.1-preview` | Body: `publisherName`, `extensionName` |72| DELETE | `/_apis/extensionmanagement/installedextensions/{publisher}/{extension}?api-version=7.1-preview` | — |7374## REST API — Artifacts7576| Method | Endpoint | Key Parameters |77|--------|----------|----------------|78| GET | `/_apis/packaging/feeds?api-version=7.1` | `$top`, `includeUrls` |79| POST | `/_apis/packaging/feeds?api-version=7.1` | Body: `name`, `upstreamEnabled` |80| GET | `/_apis/packaging/feeds/{feedId}/packages?api-version=7.1` | `protocolType`, `packageNameQuery` |8182## Analytics OData8384Endpoint: `https://analytics.dev.azure.com/{org}/{project}/_odata/v4.0-preview/`8586Key entity sets: `WorkItems`, `WorkItemRevisions`, `PipelineRuns`, `TestRuns`, `TestResults`, `TestResultsDaily`.8788Query operators: `$filter`, `$select`, `$expand`, `$orderby`, `$top`, `$apply` (for aggregations).8990## Azure DevOps CLI9192```bash93# Install94az extension add --name azure-devops9596# Configure defaults97az devops configure --defaults organization=https://dev.azure.com/{org} project={project}9899# Key command groups100az repos list / create / show101az repos pr create / list / update / complete102az pipelines list / show / run / create103az boards work-item create / show / update104az artifacts universal publish / download105106# Escape hatch for any REST API107az devops invoke --area git --resource repositories --api-version 7.1108```109110## Best Practices111112- Use security namespaces for granular permission control — avoid broad group assignments.113- Configure service hooks for real-time notifications to Teams/Slack channels.114- Create project wikis for living documentation; use code wikis for API docs.115- Use ETag-based concurrency for wiki page updates to prevent lost edits.116- Build custom dashboards per team with sprint burndown, build health, and test trend widgets.117- Use Analytics OData for Power BI dashboards — narrow filters and use `$select` for performance.118- Prefer `az devops` CLI for scripting over raw REST API calls.119- Review extension permissions before installing — extensions can access project data.120121## Progressive Disclosure — Reference Files122123| Topic | File |124|---|---|125| API surface map, failure modes, limits, safe-default patterns | [`references/operational-knowledge.md`](./references/operational-knowledge.md) |126| Artifact feeds, package types, upstreams, retention, symbols | [`references/artifact-feeds.md`](./references/artifact-feeds.md) |127| Security namespaces, token formats, ACL/ACE patterns, permissions | [`references/security-namespaces.md`](./references/security-namespaces.md) |128| Wiki types, page CRUD, ETag concurrency, page analytics | [`references/wiki-management.md`](./references/wiki-management.md) |129| Service hooks, event types, webhook targets, subscriptions | [`references/service-hooks.md`](./references/service-hooks.md) |130| Dashboard CRUD, widget types, configuration, custom widgets | [`references/dashboards-widgets.md`](./references/dashboards-widgets.md) |131| OData endpoints, entity sets, aggregation queries, Power BI | [`references/analytics-odata.md`](./references/analytics-odata.md) |132| az devops CLI, command groups, invoke escape hatch, recipes | [`references/devops-cli.md`](./references/devops-cli.md) |133| Extension management, marketplace, pipeline decorators, SDK | [`references/extensions-marketplace.md`](./references/extensions-marketplace.md) |