Most servers give you everything the token allows and leave scoping to the credential. Azure DevOps lets the client itself say 'only work items, and read-only' on the connection — which means a documentation agent and a release agent can share one token and still be different in what they can do. Check the prerequisite before planning around it: an Entra-backed organisation, and a client Microsoft supports for the remote endpoint.
Microsoft's remote server for Azure DevOps. The URL carries your organisation name, so there is no shared address. Toolsets cover work items, repositories and pull requests, pipelines, wiki, test plans, iteration capacity and Advanced Security.
- Work items, repositories and pull requests, pipelines
- Wiki, test plans and iteration capacity
- The Advanced Security toolset
- Three request headers — X-MCP-Toolsets, X-MCP-Readonly and X-MCP-Tools — that narrow what the connection can reach
Microsoft Entra ID OAuth, and an organisation backed by an Entra tenant — standalone MSA organisations are not supported. Client support is limited; Microsoft documents the local server as the route for clients that cannot use this one.
Paste a URL, then sign in — add the endpoint to your client and sign in to the vendor