## Overview


Connect FOSSA to Azure Repos to import repositories and scan them for license compliance and security issues. The connection uses Azure DevOps OAuth, so an Azure DevOps organization administrator must enable third-party OAuth access before FOSSA can connect.

## Prerequisites

You must be a **Project Collection Administrator** in your Azure DevOps organization to change the OAuth policy.

## Enabling third-party OAuth access in Azure DevOps

{% callout type="danger" %}
FOSSA cannot connect to Azure Repos until third-party application access through OAuth is enabled in your Azure DevOps organization settings.
{% /callout %}

{% steps %}
{% step title="Open Organization settings" %}
Sign in to your Azure DevOps organization at `https://dev.azure.com/{your-organization}` and click **Organization settings** in the bottom-left corner.

{% img src="/images/integrations/46dcde7-OrgSettingsPage.png" alt="Azure DevOps Organization settings page" /%}
{% /step %}
{% step title="Open Policies" %}
In the left menu under **Security**, click **Policies**.
{% /step %}
{% step title="Enable the OAuth toggle" %}
Under **Application connection policies**, toggle on **Third-party application access through OAuth**.

{% img src="/images/integrations/43606a1-OAuthTogglePoliciesPage.png" alt="Third-party application access through OAuth toggle enabled" /%}
{% /step %}
{% /steps %}

Azure Repos is now ready to connect.

## Importing repos from Azure Repos

{% steps %}
{% step title="Open the Add Projects page" %}
In FOSSA, go to **Add Projects** and select the **Quick Import** option. Choose **Azure Repos**.

{% img src="/images/integrations/deb944d-QuickImportScreen.png" alt="Quick Import screen with Azure Repos option" /%}
{% /step %}
{% step title="Connect to Azure DevOps" %}
Click **Connect with Service** to begin the OAuth authorization flow.

{% img src="/images/integrations/6b8e5d5-ConnectToServicesScreen.png" alt="Connect to Services screen" /%}
{% /step %}
{% step title="Grant FOSSA access" %}
In the Azure DevOps authorization page, click **Accept** to grant FOSSA access to your repositories.

{% img src="/images/integrations/8ac5597-Access_Approval.png" alt="Azure DevOps access approval dialog" /%}
{% /step %}
{% step title="Select an organization" %}
If you belong to more than one Azure DevOps organization, select the one you want to import from.

{% img src="/images/integrations/bfa7fd4-ADOOrgDropdown.png" alt="Azure DevOps organization dropdown" /%}

{% callout type="info" %}
If a repository doesn't appear in the list, you may not have granted FOSSA access to that organization. Return to the previous step and repeat the authorization for the correct organization.
{% /callout %}
{% /step %}
{% step title="Select repositories and import" %}
Choose individual repositories to import, or click **Import All** to import everything. When importing all, a dialog lets you review the projects before committing.

{% img src="/images/integrations/a726065-AssignToTeam.png" alt="Import All confirmation dialog" /%}

{% img src="/images/integrations/b18fe23-ImportAll.png" alt="Import All project review screen" /%}

You can filter repositories by **Public**, **Private**, or **All**, by last-updated date, and by whether to include forks.
{% /step %}
{% step title="Configure import settings" %}
Click **Next Step** to configure notifications, updates, and access permissions. The recommended settings are shown below.

{% img src="/images/integrations/2ec91f9-Notifications_only.png" alt="Notifications settings, issues only" /%}

{% img src="/images/integrations/c88213b-Updates.png" alt="Updates settings" /%}

{% img src="/images/integrations/5b1bb94-Access_AND_Badge.png" alt="Access and badge settings" /%}
{% /step %}
{% step title="Assign to teams and confirm" %}
Optionally assign the imported projects to specific teams in your organization, then click **Confirm Import Repos**.

{% callout type="info" %}
Depending on the number of repositories and their sizes, the import may take some time to complete.
{% /callout %}
{% /step %}
{% /steps %}

## Troubleshooting

### Azure Repos commits are no longer triggering new scans

When the OAuth token used for the FOSSA webhook expires or becomes invalid, new commits to Azure Repos stop appearing as project revisions in FOSSA. Regenerating the webhook issues a fresh token.

{% steps %}
{% step title="Open project settings in FOSSA" %}
Navigate to the affected project in FOSSA and go to **Settings → Update Hooks**.

{% img src="/images/integrations/12a3363-Webhook_updated.png" alt="FOSSA project Settings showing Update Hooks" /%}
{% /step %}
{% step title="Regenerate the hook" %}
Click **Auto-Regenerate Hook**. FOSSA will re-authorize with Azure Repos and create a new webhook.

{% img src="/images/integrations/c40436d-Auto-regenerate-webhooks.png" alt="Auto-Regenerate Hook button" /%}
{% /step %}
{% /steps %}

Import repos from Azure Repos and run FOSSA license and security checks as part of your Azure DevOps pipeline.

Azure Repos

Bitbucket Cloud

AWS CodeBuild

Integrations

Step-by-step onboarding paths for developers, security teams, and legal & compliance.

Install the CLI, analyze your first project, and wire FOSSA into CI so every pull request is checked automatically — no manual scans.

For Developers

Detect CVEs across your dependencies, set severity policies that gate builds, and focus on vulnerabilities that are actually reachable in your code.

For Security Teams

Surface license obligations per dependency, enforce policies that flag or block disallowed licenses, and produce audit-ready attribution reports automatically.

For Legal & Compliance

User Guides

Explore FOSSA products — compliance, security, quality, SBOM, and more.

License obligations, attribution, and policy enforcement for the open source in your code.

Compliance

Find, prioritize, and fix vulnerabilities across your dependencies.

Security

Code quality signals and dependency health monitoring.

Quality

Generate, aggregate, import, and share software bills of materials across the full SBOM lifecycle.

SBOM Management

The FOSSA AI agent for dependency upgrades, SAST security review, and AI code guardrails.

fossabot

Product Guides

New to FOSSA? Import your first project, run a scan, and see results in minutes.

Create an account, import your first project, read the results, and automate future scans.

Your First Scan

Choose between Quick Import and the FOSSA CLI based on your build environment and accuracy needs.

CLI vs Quick Import

Get Started

Get your code into FOSSA — import projects from source hosts, the CLI, or CI, then configure how they're scanned and organized.

Analyze your code locally with the FOSSA CLI and upload the results, the most accurate and secure way to integrate.

Provide dependency data from your existing CI/CD environment for faster, more accurate FOSSA scans.

CI/CD Scanning

Block PRs that introduce new license compliance or security violations using FOSSA GitHub status checks.

Pull Request Checks

Automatically add a FOSSA license-scan status badge to your GitHub README when you import a project.

Badge Pull Requests

Scan Docker and OCI container images for open source license and vulnerability issues.

Containers

Find open source code copied into your codebase without being declared as a dependency.

Snippets

Connect GitHub, GitLab, Bitbucket, or Azure Repos and scan hundreds of repositories in one click.

Quick Import

Import internal and firewalled projects into FOSSA with Broker, without sharing source-code access.

Broker

Decompose pre-compiled binaries and archives to identify open source components without source-code access.

Binaries

Import a CycloneDX or SPDX SBOM to run license and security compliance checks against its listed components.

SBOM Import

Inspect every dependency FOSSA detected, metadata, license status, filter options, custom licenses, and notice files.

Dependencies

Search, filter, and manage every package detected across all of your organization's projects from one place.

Package Inventory

Configure the title, branches, ignored dependencies, labels, VCS host, and visibility for an individual FOSSA project.

Project Settings

Exclude a specific package from your project's issue tracking and reporting.

Ignore a Dependency

Create and apply labels to organize projects and filter the dashboard by business context.

Project Labels

Keep FOSSA projects continuously scanned, re-analyze on every new revision and surface new license and security issues automatically.

Automatic Updates

How to upload an archive directly to FOSSA and how it's analyzed, for code that isn't pulled from a package registry.

Archive Upload

requirements.txt, alongside setup.py, is the most common -yet imprecise -- approach to dependency management in python projects.

Setuptools (requirements.txt/setup.py)

Quick reference: setuptools

Poetry is a tool for dependency management and packaging in Python.

Poetry

This is a modern approach to defining python project dependencies, providing very precise, complete dependency graphs for a python project.

Pipenv/Pipfile

Quick reference: pipenv

While originally created for Python programs, Conda can package and distribute software for any language. It provides a full list of all dependencies install…

Conda Analysis

PDM is a tool for dependency management and packaging in Python.

uv is a package and project manager for Python.

Python

A package.json file is required to be present all types of npm analysis.

Quick reference: npm

Yarn is a spiritual successor to the npm cli. Yarn automatically updates the yarn.lock file when the yarn CLI is used to modify the dependencies present in t…

Yarn

Pnpm is a fast, disk space-efficient package manager. Unlike npm and yarn, pnpm uses symbolic links to create a nested structure of dependencies.

Pnpm

package.json is a common build manifest used by both yarn and npmcli.

package.json

The package-lock.json file is generated when npm modifies node_modules or package.json and describes the exact dependency tree generated. One example of this…

Npm Lockfile

Quick reference: yarn

JavaScript

Go 1.11 has first-class support for "modules", which is now the preferred way to do dependency management.

Go Modules

Dep is an alternative toolchain for golang dependency management. Though go modules are the blessed form of dependency management, dep is exploring alternati…

Glide is very commonly encountered as a buildtool for older Go projects. Though deprecated, it's prevalent enough among existing projects that it warrants su…

Glide

Quick reference: gomodules

Quick reference: godep

Quick reference: glide

The V3 Go resolver is a new dynamic strategy to find dependences in go modules projects. It was first released in v3.8.5 on 2023-06-10.

What is the new package-based Go modules analysis strategy?

Maven projects are notoriously difficult to resolve into final dependency graphs. While many dependencies are declared as XML, these dependency declarations …

Maven plugin

This maven tactic uses native, mvn dependency:tree command to retrieve dependency information.

Maven - Tree Command

Maven projects use pom.xml files to declare dependencies and multi-project relationships.

Maven pom.xml

Quick reference: maven

Maven

How FOSSA's Gradle plugin tactic resolves dependencies via a Gradle init script, plus debugging steps.

Gradle build plugin

Gradle

While the other analysis strategies for gradle and maven offer some scala project coverage, scala projects overwhelmingly use the build tool sbt.

sbt Analysis

Quick reference: sbt

Scala

Quick reference: bundler

Ruby

When developing in PHP, composer is commonly used to manage dependencies.

Composer Analysis

NuGet analysis follows these strategies in sequence: 1. project.assets.json 2. PackageReference

NuGet Analysis

A .nuspec file is an XML manifest that contains package metadata for Nuget packages. This manifest is used both to build the package and to provide informati…

nuspec

Package references, using the PackageReference node, manage NuGet dependencies directly within project files (as opposed to a separate packages.config file)

PackageReference

The packages.config XML file is used in some project types to maintain the list of packages referenced by the project.

packages.config

The project.json file maintains a list of packages used in a project, known as a package management format. It supersedes packages.config but is in turn supe…

project.json

The project.assets.json file is used in .NET Core projects to manage dependencies and other resources

project.assets.json

Paket is a dependency manager for .NET projects. Paket enables precise and predictable control over your dependencies

Paket

Quick reference: Paket

.NET (C#, F#, VB)

Quick reference: cargo

Rust

Ideal/Minimum dart installed locally pubspec.yaml file present in your project pubspec.lock file present in your project, with dependencies already retrieved…

Quick reference: pub

Dart

podfile: Find all directories containing a Podfile file.

Cocoapods Analysis

Quick reference: cocoapods

Find any folder which contains a file named Cartfile.resolved.  Skip all subdirectories if one is found.

Carthage Analysis

Ideal/Minimum Cartfile.resolved file present in your project

Quick reference: carthage

Find all files named: Package.swift or find Xcode's project file named: project.pbxproj. We will not scan .build directory if the Package.swift or Xcode proj…

Swift Package Manager

iOS (Objective-C, Swift)

C/C++

Find all directories with a cabal.project file or a file with a .cabal extension.  When one is found, skip all subdirectories.

Cabal

Quick reference: cabal

Find all directories with a stack.yaml file.  When one is found, skip all subdirectories.

Stack

Ideal/Minimum stack buildtool install stack.yaml file present in your project

Quick reference: stack

Haskell

Ideal/Minimum mix installed locally mix.exs and mix.lock file present in your project

Quick reference: mix

Elixir

Ideal/Minimum rebar3 installed locally rebar.config file present in your project

Quick reference: rebar3

Erlang

Quick reference: leiningen

Clojure

Perl

Fortran

When developing in nim, nimble is used to manage dependencies.

Nimble Analysis

Currently, we only support analysis of r project which are using renv package manager.

R Analysis (renv)

dpkg

System

Supported Languages

Schedule recurring scans so FOSSA picks up newly disclosed vulnerabilities and license changes even when your code hasn't changed.

Scan Frequency

Configure who gets notified and through which channels when FOSSA detects new issues in your projects.

Notifications

Configure which issue scanners are enabled for your projects and how they gate CI/CD builds.

Issue Scanners

Control whether a FOSSA project is publicly accessible to anyone with the link or restricted to authenticated members.

Privacy Settings

View past scans for a project and trigger a rebuild or policy scan from the UI.

Build History and Rebuilding

How FOSSA handles transitive dependencies whose version is resolved by the package manager when multiple constraints conflict.

Mediated Dependencies

Project Setup

Bundle related projects into a single unit for shared reporting, policy enforcement, and release tracking.

Create a release group, add projects, and configure your first release.

Creating a Release Group

Clone, edit, and manage releases within a release group to track compliance at specific points in time.

Managing Releases

Review licensing, security, and quality issues aggregated across all projects in a release group.

Issues

Browse the unified dependency inventory and license breakdown across all projects in a release group.

Inventory & Licenses

Generate licensing, vulnerability, SBOM, and remediation guidance reports across all projects in a release group.