Skip to main content

​
Overview

This guide covers how to add the generated public SSH key to Azure DevOps Repos for repository access.
Before you start: Create your Git integration first by following the integration form instructions. You’ll need the public SSH key from that integration.

​
Prerequisites

  • Access to Azure DevOps
  • Read permissions on the repository you want to integrate
  • Public SSH key from your Git integration
  • A service account or user account to add the SSH key to
⏱️ Estimated time: 10 minutes
Important: Azure DevOps does not support repository-level deploy keys. You must use a service account or user account with SSH keys. The account should have Read permissions only on the repository.

​
IP Whitelisting (If Required)

If your Azure DevOps organization uses IP restrictions, add the Coalesce Quality egress IP addresses for your region. See IP Whitelist for the complete list. For instructions on configuring IP restrictions in Azure DevOps, see Azure DevOps’ guide on IP address restrictions.

​
Setting Up SSH Access

​
Step 1: Create or Use a Service Account

  1. Create a dedicated service account (recommended) or use an existing account
  2. Grant the account Read permissions on the repository:
    • Navigate to Project Settings > Repositories
    • Select your repository
    • Go to Security tab
    • Add the service account with Read permission only
Using a dedicated service account makes it easier to audit and revoke access if needed.

​
Step 2: Add SSH Public Key

  1. Sign in to Azure DevOps with the service account
  2. Click on your User settings icon (top right)
  3. Select SSH public keys
  4. Click + New Key
  5. Configure the SSH key:
    • Name: Enter a descriptive name (e.g., Coalesce Quality Integration)
    • Public Key Data: Paste the complete public SSH key from your integration
Make sure to paste the complete key including the ssh-rsa or ssh-ed25519 prefix.
  1. Click Add
The SSH key is now active for this account.

​
Step 3: Verify Repository Access

Ensure the service account has access to the specific repository:
  1. Navigate to Project Settings > Repositories
  2. Select your repository
  3. Go to Security tab
  4. Verify the service account is listed with Read permissions

​
Repository URL Format

When configuring the integration, use the Azure DevOps SSH URL format: Format: git@ssh.dev.azure.com:v3/organization/project/repository Example: git@ssh.dev.azure.com:v3/mycompany/DataPlatform/analytics-repo

​
Commit URL Format

Coalesce Quality detects the commit URL for Azure DevOps automatically. Set Commit URL format in the integration form only if commit links open the wrong page. Write the full URL of your repository and use only the {hash} placeholder: https://dev.azure.com/<organization>/<project>/_git/<repository>/commit/{hash} Example: https://dev.azure.com/mycompany/DataPlatform/_git/analytics-repo/commit/{hash}

​
Finding Your Repository URL

To find your repository’s SSH URL:
  1. Go to your repository in Azure DevOps
  2. Click Clone button (top right)
  3. Select SSH tab
  4. Copy the URL (it will be in the format above)

​
Troubleshooting

​
SSH key not working

  • Verify the complete public key was copied (including the ssh-rsa or ssh-ed25519 prefix)
  • Ensure the SSH key was added to the correct user/service account
  • Confirm the account has Read permissions on the repository

​
Connection refused

  • Check that your organization’s IP restrictions (if configured) include the Coalesce Quality egress IPs
  • Verify the repository SSH URL uses the correct format: git@ssh.dev.azure.com:v3/org/project/repo
  • Ensure the URL has v3 in the path (required for Azure DevOps Git)

​
Permission denied

  • Verify the service account has explicit Read permissions on the repository
  • Check that the account is not disabled or expired
  • Ensure the SSH key is added to the same account that has repository access

​
SSH URL format issues

  • Azure DevOps requires a specific SSH URL format: git@ssh.dev.azure.com:v3/org/project/repo
  • Do not use HTTPS URLs - only SSH URLs are supported
  • The v3 in the path is required
  • Organization, project, and repository names are case-sensitive

​
Security Best Practices

  1. Use a dedicated service account for the integration
  2. Grant Read permissions only - write access is never needed
  3. Regularly audit access - Review service account permissions periodically
  4. Enable IP restrictions - Limit access to the Coalesce Quality egress IPs
  5. Monitor access logs - Check for unexpected authentication attempts

​
Additional Resources