Implement a way to filter by project in Azure DevOps when creating a VCS integration, so that such an integration can only be used for git repositories within that project.
FYI Logan I’ve escalated this to my engineering team, please stay tuned for updates.
Blush Frog
•
Feb 18
Hi Marcin,
Yes, we'd still want project-level filtering even if AzDO licensing were free. The underlying need isn’t primarily cost; it’s governance, blast-radius reduction, and keeping governance configuration aligned between products: Azure DevOps Projects are the primary security and ownership boundary when following Microsoft's setup recommendations, and an AzDO VCS integration without a filter function effectively bypasses that boundary.
Black Breeze
•
Feb 18
Thanks for the detailed write-up, Logan — really helpful context.
We want to make sure we understand the underlying need: if AzDO licensing weren't a factor and you could create as many PAT-owning users as you wanted at no extra cost, would you still want project-level filtering on the Spacelift side? In other words, is there an access control or governance reason to scope integrations to specific projects, or is the main pain point the cost of working around AzDO's current limitations?
Either way it's useful feedback — we just want to make sure we're solving the right problem. Thanks!
Log in to comment and vote
Comments5
Black Breeze
Feb 23
FYI Logan I’ve escalated this to my engineering team, please stay tuned for updates.
Blush Frog
Feb 18
Hi Marcin,
Yes, we'd still want project-level filtering even if AzDO licensing were free. The underlying need isn’t primarily cost; it’s governance, blast-radius reduction, and keeping governance configuration aligned between products: Azure DevOps Projects are the primary security and ownership boundary when following Microsoft's setup recommendations, and an AzDO VCS integration without a filter function effectively bypasses that boundary.
Black Breeze
Feb 18
Thanks for the detailed write-up, Logan — really helpful context.
We want to make sure we understand the underlying need: if AzDO licensing weren't a factor and you could create as many PAT-owning users as you wanted at no extra cost, would you still want project-level filtering on the Spacelift side? In other words, is there an access control or governance reason to scope integrations to specific projects, or is the main pain point the cost of working around AzDO's current limitations?
Either way it's useful feedback — we just want to make sure we're solving the right problem. Thanks!