> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Service Account

> Create a dedicated Azure DevOps user and token so CodeAnt reviews are attributed to that account.

A service account is a dedicated user, such as `codeant-ai-bot`, whose personal access token CodeAnt uses to read repositories and post reviews. Use it when you want automated activity attributed to a separate account and managed independently of a developer's membership.

> [!NOTE]
>
> To connect Azure DevOps Services without a user PAT, use [Microsoft Entra workload identity](https://docs.codeant.ai/setup/azure_devops/cloud/entra_workload_identity.md).

## Before you begin

* A dedicated Microsoft Entra user with a company email address. Ask your identity administrator to create it if it does not exist.
* An Azure DevOps administrator who can add users and assign project access.
* Permission for the dedicated user to create PATs under your organization's policy.
* The projects and repositories CodeAnt should access.

## Create the account and token

**1. Add the dedicated user to Azure DevOps**

Open the Azure DevOps organization and go to **Organization settings** → **Users** → **Add users**.

Enter the dedicated user's email address. Set **Access level** to **Basic**, select the projects CodeAnt should access, and add the user. Follow [Microsoft's user management guide](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/add-organization-users?view=azure-devops) if you need help assigning access.

**2. Check repository permissions**

In each selected project, open **Project settings** → **Repositories** → **Security** and select the dedicated user. Confirm that the account has **Read** and **Contribute to pull requests** access, with no inherited or explicit Deny blocking them.

**Contribute to pull requests** allows review activity. **Contribute** is a separate permission for pushing code; grant it only if you want CodeAnt to perform code writes. See [Microsoft's repository permission definitions](https://learn.microsoft.com/en-us/azure/devops/repos/git/set-git-repository-permissions?view=azure-devops).

**3. Create the PAT as the dedicated user**

Sign in to Azure DevOps as the dedicated user. Open **User settings** → **Personal access tokens** and select **+ New Token**.

Name the token `CodeAnt AI`, select the intended organization, and choose an expiry date permitted by your policy. Select these scopes:

| Scope | Access | Used for |
| - | - | - |
| Code | Read & write | Repository access and analysis |
| Pull Request Threads | Read & write | Review comments and threads |
| Build | Read | DORA metrics |
| Work Items | Read & write | Metrics and ticket creation |

**Code** and **Pull Request Threads** are the scopes for scans and reviews. Add **Build** for DORA metrics and **Work Items** for work item data and Azure DevOps ticket creation.

Select **Create** and copy the token before leaving the page. The PAT inherits the dedicated user's access; scopes do not grant access to projects the user cannot reach.

## Connect and verify the account

1. Use the dedicated user's PAT in the [CodeAnt organization connection](https://docs.codeant.ai/setup/azure_devops/cloud/control_center.md).
2. Use the same PAT in both subscriptions from the [pull request review setup](https://docs.codeant.ai/setup/azure_devops/cloud/pull_request.md).
3. Confirm that an expected repository appears in CodeAnt.
4. Open a new PR in that repository and check that CodeAnt's review comments are attributed to the dedicated account.

Existing comments keep their original author when you change credentials. Verify attribution with a new review after updating both service hooks and the CodeAnt connection.

## Replace the token before it expires

1. Sign in as the dedicated user and create a new PAT with the same scopes.
2. Update the saved token in CodeAnt and in both CodeAnt service hook subscriptions.
3. Request a review and confirm that it succeeds.
4. Revoke the old PAT in Azure DevOps.

Keep the dedicated user's project access limited to the repositories you use, and review it when projects are archived or removed from the integration.

## Troubleshooting

> [accordion] The account cannot see the repository
>
> Check its **Basic** access level, project membership, and repository **Read** permission. Check inherited Deny settings as well as the permissions assigned directly to the user.

> [accordion] The account can read code but cannot post reviews
>
> Confirm **Contribute to pull requests** access and the PAT's **Pull Request Threads: Read & write** scope. Check that both service hook subscriptions use this PAT. If review posting still fails, [contact CodeAnt support](mailto:support@codeant.ai) with the project and PR URL. Do not include the token.

> [accordion] New comments still show a developer's name
>
> Confirm that the PAT was created while signed in as the dedicated user, then update both service hooks and the saved CodeAnt connection. Open a new PR to verify the author; existing comments do not change attribution.

## Next steps

> [card] [Connect your organization](https://docs.codeant.ai/setup/azure_devops/cloud/control_center.md)
>
> Save the dedicated user's PAT and verify repository access.

> [card] [Enable pull request reviews](https://docs.codeant.ai/setup/azure_devops/cloud/pull_request.md)
>
> Configure the project service hooks with the dedicated user's PAT.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.