# Reported issues for Azure DevOps (ADO)

Pod holds 24 of 532 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [Azure DevOps (ADO)](/mcp/azure-devops-ado).

## Most discussed

### [REMOTE] AADSTS70007: unsupported mode 'query' — default interactive auth fails before any browser prompt (local stdio server, Windows 11 / Node 24)

## Description

### Summary

With the default `interactive` authentication method, every tool call fails at token
acquisition with:

```
AADSTS70007: The application requested an unsupported mode 'query' when requesting a token.
Trace ID: <redacted>  Correlation ID: <redacted>
```

No browser window ever opens — the failure happens roughly 4 seconds after start, before any
sign-in prompt appears. The MCP server process itself starts and completes the protocol
handshake normally, and the client h

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1461) · 2026-07-27 · closed · external user · 11 comments

### AADSTS70007: unsupported mode 'query' — default interactive auth fails outside Codespaces; only -a azcli works

**Version:** `@azure-devops/mcp@2.8.1`
**OS:** Windows 10 Enterprise N 19045, Node v22.14.0
**Client:** Claude Code (stdio MCP); also reproduced running the server standalone
**Org:** two organizations, both in the same Entra tenant (resolved correctly via `x-vss-resourcetenant`)

#### Summary

With the default authentication type, **every tool call fails immediately** with:

```
AADSTS70007: The application requested an unsupported mode 'query' when requesting a token.
```

Passing `-a azcli` f

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1451) · 2026-07-25 · closed · external user · 13 comments

### VS30063 authorization error with mcp.dev.azure.com in multi-tenant environments

This template is for **Azure DevOps Remote MCP Server feedback only**.

**Important**
**Internal Microsoft users:** Do **NOT** file issues here. Please use the internal Teams channel to share your feedback.

## Issue Type

Select the option that best describes your issue.

- [X] Feedback on Remote MCP Server
- [ ] Bug in Remote MCP Server
- [ ] Tool or feature request for Remote MCP Server

## Tool(s)

If this issue is related to an **existing tool**, provide the exact tool name(s).

If this is 

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1033) · 2026-03-19 · closed · external user · 12 comments

### Authentication failure with the new auto redirect

After updating to latest version of the MCP I'm not able to run any tools anymore. 

- I had the `az login` 
- The mcp.json with the input is configured
- I then try to use `core_litst_projects`
- Copilot auto-redirects me on the web
- The page on web gives me: `Auth code was successfully acquired. You can close this window`
- Copilot fails to run the tool:
  - Input: `{}`
  - Output: `Error etching projects: network_error: Network Request Failed`

However if I run: 

`az devops project list -o 

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/540) · 2025-09-30 · closed · external user · 12 comments

### TF400813 Authentication Error: MCP Server Uses Different User ID Than Azure CLI

## Issue Description
The Azure DevOps MCP Server consistently returns `TF400813: The user '[UNKNOWN_USER_ID]' is not authorized to access this resource` error, despite Azure CLI authentication working perfectly.

## Environment
- **VS Code**: Latest version
- **Node.js**: v22.9.0
- **Azure CLI**: v2.70.0 with azure-devops extension
- **MCP Configuration**: Standard configuration from documentation

## Problem Details
The MCP server appears to authenticate with user ID `[UNKNOWN_USER_ID]` instead

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/413) · 2025-08-08 · closed · external user · 32 comments

### Allow Interactive Browser Authorization for Machines without Azure CLI

Hi!

I would like to adapt the auth logic to fallback to interactive browser credentials if the Azure CLI is not present on the client machine. 

This caters to users working in protected environments who have restricted access to install things on their machines. 

Is this something that'll help with the project's vision?

Thanks!

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/306) · 2025-07-18 · closed · external user · 12 comments

### Install doesn't work anymore

I had previously installed the MCP in my global user settings, so that I didn't need to setup it up per repo. Something changed (don't know what) the MCP was unloaded, and was no longer in my settings.json. Now when I click on the quick install link, it pops this up in VSCode

<img width="612" height="437" alt="Image" src="https://github.com/user-attachments/assets/c2e46d2a-1b2f-4f03-b4c7-dce19270dbbb" />

and it never finishes installing. I have tried both in a blank folder and with a repo open

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/286) · 2025-07-16 · closed · external user · 17 comments

### Not authorized to access this resource.

Trying to get projects or repositories and keep on getting
`TF400813: The user '2d6245bf-XXXX-XXXX-XXXX-XXXXXXXXXXXX' is not authorized to access this resource.`
But...I am authorised to see all of our projects, repositories and so on.
Also, when using API calls using PAT everything works.

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/148) · 2025-06-29 · closed · external user · 15 comments

## Most recent

### wit_work_item_write rejects a well-formed Hyperlink relation with a type-serialization error

**What happened**
Calling `wit_work_item_write` to add a Hyperlink relation to a work item fails
twice with a type-serialization error:

Value {"rel":"Hyperlink","url":"..."} does not match the expected type ...WorkItemRelation

**What was expected**
The relation should be added, the same way it is when calling the Azure DevOps
REST API directly with an identical payload shape. A direct REST PATCH to
`_apis/wit/workitems/{id}` with the same relation shape succeeds immediately
with no changes to 

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1561) · 2026-08-28 · open · external user · 1 comment

### Tool request -- extend the PR comment tool to allow updating existing comment

## Replace the content with your actual issue making sure to keep similar style so that GitHub Copilot can generate this change for you!

# Summary

Current PR commenting tool only supports creating new comment or replying to one - editing existing comment (or reply) is not supported

# Tools

# Rules

1. Adhere strictly to existing project standards and coding conventions.
2. Ensure each tool exposes all API parameters (required and optional).
3. Use the official [Azure DevOps Node API](https:

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1560) · 2026-08-28 · open · external user · 1 comment

### [REMOTE] Tool availability question

## Issue Type

- [ ] Tool or feature request for Remote MCP Server

## Tool(s)
wit_work_item_attachment_upload

## Description

Curious if  wit_work_item_attachment_upload & wit_work_item_attachment_link tool is available and working since I added Remote Azure DevOps MCP within Copilot Studio Agent (preview version) and wasn't able to get agent to upload files.

**Model responded with following message:

Azure DevOps attachment tool available to me in this environment doesn't accept a file path 

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1558) · 2026-08-27 · closed · external user · 2 comments

### Support editing Azure DevOps pipeline tags in MCP server

## Issue Type

- [x] Tool or feature request for Remote MCP Server
- [ ] Feedback on Remote MCP Server
- [ ] Bug in Remote MCP Server

## Tool(s)

### Proposed new capability

Support editing Azure DevOps pipeline tags within the Pipelines toolset.

Possible implementation options:

1. New tool: `pipelines_get_tags`
   - Retrieve tags for a pipeline.
   - Return the current tag set for a pipeline definition.

2. New tool: `pipelines_add_tags`
   - Add one or more tags to a pipeline.
   - Preserv

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1556) · 2026-08-27 · open · external user · 0 comments

### [REMOTE] Emit per-tool readOnlyHint annotations so read-only MCP clients (GitHub Copilot PR review) don't filter out every tool

### Summary

The local MCP server (@azure-devops/mcp over stdio) registers all tools without MCP annotations, including annotations.readOnlyHint.

As a result, MCP clients that enforce a read-only tool policy treat every Azure DevOps tool as potentially state-changing and filter them all out, even when a tool only performs read operations. In GitHub Copilot PR review, this shows up as:

`no allowed tools after filtering
`

According to the MCP specification, readOnlyHint is optional, but when it

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1555) · 2026-08-27 · open · external user · 1 comment

### Work item artifact links allow references to missing Azure DevOps resources

The work item link tools can add artifact relations for non-existent pull requests, branches, commits, or builds:

- `wit_work_item_link_write:link_to_pull_request`
- `wit_work_item_link_write:add_artifact_link`

Azure DevOps stores the artifact URI without validating that the target exists, leaving a dangling relation.

Expected behavior: for PR, branch, commit, and build links, validate the target in the specified project and repository before updating the work item. Valid targets should remai

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1547) · 2026-08-25 · closed · external user · 2 comments

### Pull request vote reports success when the pull request does not exist

`repo_pull_request_write` with `action: "vote"` can report success for a non-existent pull request.

The current flow treats a missing reviewer as valid and does not independently confirm that the target pull request exists or that the vote was applied.

Expected behavior: validate the pull request in the requested project and repository before voting, and do not report success without a confirmed update.

Would you accept a focused PR with missing-PR and successful-vote tests?

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1546) · 2026-08-25 · closed · external user · 2 comments

### Missing resources can produce successful or invalid MCP results

Several handlers do not validate `null` or `undefined` responses for required resources:

- `repo_pull_request_thread:list_comments` can produce an invalid result with undefined text.
- `repo_pull_request_write:update` can report that a pull request was updated when no data was returned.
- `pipelines_build:get_status` can return `null` for a missing build.

Expected behavior: a missing required resource should return a valid MCP error result with a clear Not Found message, and `content[].text` s

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1545) · 2026-08-25 · closed · external user · 3 comments

### `core_list_projects` name filter misses projects outside the first page

`core_list_projects` applies `projectNameFilter` after calling `getProjects` with the requested `top`.

As a result, a project outside the first page is missed:

```json
{
  "top": 5,
  "projectNameFilter": "TargetProject"
}
```

This can return an empty array, while the same filter with a larger `top` finds the project.

Expected behavior: when `projectNameFilter` is provided, pagination should continue until `top` matching projects are found or all projects are exhausted. Calls without the nam

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1544) · 2026-08-25 · closed · external user · 2 comments

### Add tool to list pull request policy evaluations

# Summary

No tool reports why a pull request is blocked. `repo_pull_request` returns `mergeStatus`, votes and `completionOptions`, but never the policy results, and the statuses API does not cover branch policies. #843 raised this and was closed as completed without a tool shipping, same for #1276.

The policy evaluations API does cover them, and it is already reachable through `getPolicyApi()` in the official Node API. It also answers the original ask in #843: the `context` of a build evaluati

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1543) · 2026-08-24 · closed · external user · 0 comments

### [REMOTE] repo_file get_content returns a base64 blob with a schemeless URI; local server v2.9.0 returns plain text

This template is for **Azure DevOps Remote MCP Server feedback only**.

**Important**
**Internal Microsoft users:** Do **NOT** file issues here. Please use the internal Teams channel to share your feedback.

## Issue Type

Select the option that best describes your issue.

- [ ] Feedback on Remote MCP Server
- [x] Bug in Remote MCP Server
- [ ] Tool or feature request for Remote MCP Server

## Tool(s)

`repo_file` (action: `get_content`)

## Description

`repo_file` with `action: get_content` on

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1540) · 2026-08-24 · open · external user · 1 comment

### Add tools for Test Configurations

# Summary
The Test Plans domain (testplan, testplan_test_plan_write, testplan_test_suite_write, testplan_test_case_write) covers plans, suites, cases, and results, but there's no tool for Test Configurations — the named variable combinations (e.g. "Windows 11 + Chrome") that get assigned to test suites/cases and have their own Active/Inactive state.

# Tools
- testplan_list_configurations — wraps GET _apis/test/configurations (or ITestApi.getTestConfigurations in azure-devops-node-api), returnin

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1535) · 2026-08-20 · closed · external user · 1 comment

### [REMOTE]

This template is for **Azure DevOps Remote MCP Server feedback only**.

**Important**
**Internal Microsoft users:** Do **NOT** file issues here. Please use the internal Teams channel to share your feedback.

## Issue Type

Select the option that best describes your issue.

- [ ] Feedback on Remote MCP Server
- [X] Bug in Remote MCP Server
- [ ] Tool or feature request for Remote MCP Server

## Tool(s)

-

## Description

We are testing Microsoft Azure DevOps Remote MCP with both github Copilot i

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1531) · 2026-08-18 · closed · external user · 1 comment

### wit_add_child_work_items writes the description into Microsoft.VSTS.TCM.ReproSteps on every work item type

## What happens

`wit_add_child_work_items` unconditionally writes the supplied description into two fields:

```js
// dist/tools/work-items.js (v2.9.0), batch body construction
{ op: "add", path: "/fields/System.Description", value: encodedDescription },
{ op: "add", path: "/fields/Microsoft.VSTS.TCM.ReproSteps", value: encodedDescription },
```

The same duplication is applied to `multilineFieldsFormat` when `format: "Markdown"` is set.

## Why this is harmful

For a Bug in a process template 

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1527) · 2026-08-17 · closed · external user · 1 comment

### Failed to fetch tenant for Azure DevOps organisation - all authentication methods fail

Package:
@azure-devops/mcp

Versions Tested:
- 2.8.1
- 2.9.0

Operating System:
Windows

Node Version:
v24.19.0

Azure DevOps Organisation:
https://dev.azure.com/IT-BrandProtection

Issue:

The MCP loads successfully and exposes Azure DevOps tools, however all Azure DevOps API calls fail.

Authentication methods tested:

- pat
- envvar
- interactive

All produce the same result.

Observed Behaviour:

The MCP starts successfully.

Example:

npx -y @azure-devops/mcp IT-BrandProtection --authentica

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1522) · 2026-08-14 · closed · external user · 3 comments

### add_child work items: ReproSteps is written unconditionally, populating non-Bug types (Task/User Story/Feature) with a duplicate, stale description

## Summary

In `src/tools/work-items.ts`, the `add_child` action unconditionally writes the item's `description` into **both** `System.Description` and `Microsoft.VSTS.TCM.ReproSteps` for every child work item, regardless of work item type.

`Microsoft.VSTS.TCM.ReproSteps` ("Repro Steps") only exists on the **Bug** work item type in the Agile/Scrum process templates. Writing it to Tasks, User Stories, Features, etc. populates a field those types don't semantically own.

## Location

`src/tools/w

[Read the thread](https://github.com/microsoft/azure-devops-mcp/issues/1521) · 2026-08-14 · closed · external user · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/microsoft/azure-devops-mcp/issues).