Azure DevOps Peer Reviewer Assistant
Last updated: Oct 26, 2026
Available only for cloud-hosted Azure DevOps organizations. Azure DevOps Server (on-premises) is not supported.
You connect Azure DevOps one time for each organization, in the SCM connections screen. Then you select the groups that get their pull requests reviewed.
Your Azure DevOps organization must be connected to a Microsoft Entra directory. An organization that belongs to a personal Microsoft account cannot be connected: the sign-in accepts only work or school accounts. You see which directory your organization uses in Organization settings, Microsoft Entra.
Roles required: Organization Manager in Fluid Attacks. In Azure DevOps, Project Collection Administrator of the organization. In your Microsoft Entra directory, a Global Administrator approves the Fluid Attacks application one time; if you are not one, Entra shows Need admin approval and an administrator must approve it before you continue.
An Azure DevOps organization connects to one Fluid Attacks organization. Connect it from the organization that owns the groups that you want to review.
Pull request review is available to groups with an active Essential or Advanced plan.
1. Open the SCM connections screen
- In your organization, go to Integrations.
- Open the SCM connections tab.
- Click Connect SCM.
2. Select the provider
The Choose your provider window opens. Click the Azure DevOps card.
3. Examine what the connection adds
The Prepare the connection window explains what Fluid Attacks adds to your Azure DevOps organization. It is not an extension of the marketplace: you do not find it in Organization settings, Extensions.
| What the connection adds | Why it needs it |
|---|---|
| A service principal with Basic access | To read the code and to publish the result on the pull request |
| Read of code and contribute to pull requests | To read the code that the assistant examines and to publish its result |
| Two service hook subscriptions | To know when a pull request is created or updated |
The service principal consumes one Basic license of your Azure DevOps organization, the same as a user. Examine Organization settings, Billing if your organization is at the limit of its free licenses.
4. Sign in and select the organization
- Sign in with the work or school account that administers the organization. This sign-in lists the organizations that your account administers.
- Select the organization that you want to connect.
- The platform then sets the organization up: it adds the service principal, gives it the Git permissions and creates the subscriptions.
The setup asks Microsoft Entra for a second authorization with more permissions. Entra uses the session that you opened, thus you see only one sign-in. Entra shows a second sign-in when it cannot use that session. This occurs the first time that the directory approves the application.
A Connection established message confirms the setup.
If the setup stops and asks for an administrator, your account is not a Project Collection Administrator of the organization. Only that role can give the Git permissions.
5. Select the groups that get reviewed
The connection card has a Pull request review section. This section has one toggle for each group in the organization.
Turn on the toggle of each group that you want the assistant to review. The assistant does not review a group with its toggle off, and Azure DevOps shows no result.
The assistant reviews the repositories that this group registered as Git roots. The branch of each root is its registered branch, and the assistant compares every pull request against it. Refer to Add a new Git repository.
Refer to Which pull requests the assistant reviews for all the conditions that a pull request must obey.
6. Verify that the connection operates
- Open or update a pull request in one of the repositories that you added.
- Make sure that the status Peer Reviewer Assistant reports on the pull request.
- Make sure that a summary comment appears in the conversation.
The assistant publishes three things:
| What it publishes | Where you see it |
|---|---|
| A status | In the pull request, with the result and a link to the platform |
| A summary comment | In the conversation of the pull request |
| A comment on the line | In the diff, on each line that introduces a vulnerability |
The status of Azure DevOps shows one line of text. The complete result is in the summary comment and in the platform.
Which pull requests the assistant reviews
The assistant reviews a pull request only when all these conditions are true. If one condition is false, Azure DevOps shows no result.
| Condition | Where you set it |
|---|---|
| The repository belongs to a project that existed when you connected | In Azure DevOps |
| The group has pull request review on | Integrations, SCM connections, Pull request review |
| The repository is a Git root of that group | Scope section of the group |
| That root is Active | Scope section of the group |
| The group has an active Essential or Advanced plan | Group information |
A project that you create after you connect the organization is not covered: its repositories do not appear when you add repositories. Click Connect SCM again on the same organization and the connection takes the projects that it lacks. You do not have to disconnect.
The assistant reviews each pull request of a repository that you registered on the platform. The branch that the pull request targets does not change this.
Block the merges that disobey your policy
The status alone does not block a merge. To block a merge, add a branch policy on the target branch:
- Open a pull request. Azure DevOps lists a status only after it receives that status one time.
- Open the branch policies of the target branch: Repos, Branches, the More options icon of the branch, Branch policies. You reach the same screen from Project settings, Repository, Policies, Branch Policies, and the branch.
- Below Status checks, select +.
- In Status to check, select
fluidattacks/peer-reviewer-assistant. If the status has not reported yet, write that value. - Set Policy requirement to Required.
To edit the policies of a branch you must belong to the Project Administrators group, or have the Edit policies permission of the repository. This is not the same role that connects the organization.
Microsoft explains the mechanism in its own documentation: Set and manage branch policies.
A necessary status also blocks the merge when the scan does not end. The Incomplete result reports a failure, because Fluid Attacks cannot tell you that the change is safe. Push a new commit.
Manage the connection
The connection card has these controls:
| Control | What it does |
|---|---|
| Status | Shows Connected or Suspended |
| Verify again | Examines the connection again |
| Disconnect | Removes the service principal and the subscriptions from the Azure DevOps organization |
When an administrator disables the Fluid Attacks application in Microsoft Entra, the status is Suspended. The assistant does not review pull requests, and the platform does not turn on the review of a group. Enable the application again in Microsoft Entra, then click Verify again.
Disconnect removes the subscriptions and the membership of the service principal, which frees its Basic license. The assistant stops the review of pull requests. The toggles of the groups go off. If you connect again, you must select the groups again.
The repositories that you added through this connection use its credential to clone. After you disconnect, the platform can no longer clone them, and their next clone fails. Give those repositories another credential before you disconnect.
Related information
GitLab Peer Reviewer Assistant
Set up the Fluid Attacks Peer Reviewer Assistant for GitLab to get automated vulnerability scanning and comments on merge requests.
Troubleshooting
Correct the usual problems of the Peer Reviewer Assistant: a pull request without a review, a check that does not change, the messages that reject an exception or a connection, and the expiration of the GitLab token.