Azure DevOps Work Items (Public Preview)

Sometimes, an alert detected by Monte Carlo may take weeks to fix, or requires work from someone outside the data team. Converting alerts like these into work items in Azure DevOps makes it easy to track work over weeks or months, and mobilize resources from teams not in Monte Carlo.

This integration allows:

• Users in Monte Carlo to click a button to convert an alert into a work item in Azure DevOps, or link an existing work item. Multiple Azure DevOps work items may be linked or created from a single alert in Monte Carlo.
• Monte Carlo to automatically send notifications directly to Azure DevOps to create work items.
• Changes to alert status, priority, and owner in Monte Carlo are automatically synced to the linked Azure DevOps work items.

Integration setup

An Account Owner must go to Settings > Integrations. In the Notifications and Collaboration section, click Create and select Azure DevOps.

Azure DevOps can be integrated with either OAuth Authentication or Personal Access Token (PAT) Authentication. Follow the steps below to set up your preferred authentication method.

1. Authentication Setup

Choose one of the following authentication methods:

a. OAuth Authentication

Create a MonteCarlo Application in Microsoft Entra

Login to Microsoft Entra, navigate to "Applications" -> "App registrations" and click on "New registration". Complete the form as follows:

• Name: MonteCarlo
• Account type: Single tenant
• Redirect URI: Web | https://getmontecarlo.com/auth/callback/azure-devops

Click "Register" to create the new application.

Copy and save the Application (client) ID and Directory (tenant) ID so they can be entered into MonteCarlo later.

Configure Client Secret

Navigate to "Certificates & secrets" and click "New client secret". Enter "MonteCarlo" for the description and select your desired expiry.

Click "Add".

Copy and save the Client Secret (Value) so it can be entered into MonteCarlo later.

Configure Permissions

In the new application, navigate to "API Permissions". Under "Configured permissions", click "Add a permission". Select "Azure DevOps" and add the following permission:

• vso.work_write

Click "Add permissions".

Add Application to Azure DevOps

Navigate to your organization in Azure DevOps. Select "Organization settings" -> "Users" and click the "Add users" button. Start typing "MonteCarlo" to find the newly created Microsoft Entra application and select it. Under "Add to projects" select the projects that you may want to use with MonteCarlo and then click "Add".

b. Personal Access Token (PAT) Authentication

Create a Personal Access Token in Azure DevOps

In Azure DevOps, select "User settings" in the top right-hand corner and click "Personal access tokens". Click the "New Token" button and name the token "MonteCarlo". Select the desired expiry but be aware that the token will need to be manually updated in MonteCarlo once it expires.

Grant Read & write permission for Work Items.

Click "Create" to create the token. Copy and save the token value so it can be entered into MonteCarlo.

2. Grant Required Project Permissions

For each project you wish to use, perform the following:

1. Navigate to your project in Azure DevOps

2. Go to "Project settings" (bottom left) -> "Repositories" -> "Security"

3. Find the MonteCarlo application (for OAuth) or your user account (for PAT) in the users/groups list

4. Click on the identity to select it

5. Locate the following permissions and set them to Allow:

   • Contribute → Allow (this includes tag creation)
   • Read → Allow (if not already set)
   • Create tag → Allow (optional, as it's included in Contribute)

6. Changes are typically auto-saved

3. Create Azure DevOps Integration in MonteCarlo

Login to MonteCarlo and navigate to "Settings" -> "Integrations". Under "Notifications and collaboration" click "Create" and select "Azure DevOps".

For OAuth Authentication:

• Enter the name of your Azure DevOps organization
• Enter the Tenant ID, Client ID, and Client Secret you saved earlier
• Click "Create"
• You will be redirected to Microsoft to grant the requested access
• Once granted, you will be redirected back to MonteCarlo where your Azure DevOps integration is now connected

For Personal Access Token Authentication:

• Select "Access Token" authentication
• Enter the name of your Azure DevOps organization
• Enter your personal access token
• Click "Create"
• Your Azure DevOps integration is now connected

Field Mappings

When Monte Carlo creates or updates work items in Azure DevOps, the following field mappings are applied:

Status Mapping

Monte Carlo alert statuses are mapped to Azure DevOps work item states:

• No status, Acknowledged, Work in progress → To Do
• Fixed, Expected, No action needed, False positive → Done

Priority Mapping

Monte Carlo alert priorities are mapped to Azure DevOps priority values:

• P1 → Priority 1
• P2 → Priority 2
• P3 → Priority 3
• P4, P5, or no priority → Priority 4

Owner Mapping

When an alert owner is assigned in Monte Carlo, the integration will attempt to assign the work item to the corresponding Azure DevOps user by matching email addresses.

Creating an Azure DevOps Work Item from a Monte Carlo Alert

After the integration is set up, a user has two different ways they can create an Azure DevOps work item from a Monte Carlo alert:

• Add Azure DevOps as a recipient in an Audience. Notifications sent to Azure DevOps will generate a work item.
• Click a button from alert page that lets them create a new Azure DevOps work item or link an existing one

To create an Azure DevOps work item from the alert page, first click the Azure DevOps button on the top-right.

Once clicked, a slide-out opens. If creating a new Azure DevOps work item, the user can input the Project, Work Item Type (Issue or Task), Title, and Description. Title and Description are pre-populated with some information about the alert and a URL to link back to the alert in Monte Carlo.

Click Create, and the user is given a confirmation that a work item has been created, along with a 1-click link to view the work item in Azure DevOps. This process can be repeated to link multiple Azure DevOps work items to the alert.

Interacting with Azure DevOps Work Items from within Monte Carlo

Once an Azure DevOps work item is created or linked to an alert, it is visible from within the alert page and from the Alert Feed. There is also a filter on the Alert Feed to only see alerts with an Azure DevOps work item.

Once an Azure DevOps work item is created or linked to an alert, any Slack notifications from that alert are updated to show that the link was made.

Automating Azure DevOps Work Item Creation through Notifications

You can add Azure DevOps as a recipient of an audience. As a result, a work item in Azure DevOps will be created any time an alert is sent to that audience.

To get started, navigate to Notifications and click "Create audience." Add a recipient and integrate it with your Azure DevOps account, making sure to link it to the correct project and work item type.

Once your audience is created, go to 'Other Notifications' and click the "+" icon to add a new notification setting to the audience. Select the alerts you'd like to automatically generate Azure DevOps work items for and click "Create notification" to save your settings.