Forum Discussion
JamesSeton
Oct 28, 2024Copper Contributor
Azure Devops External Users can't access project after being added
We have a private free repo that we have added external contractors to. They show up as guest in our Entra tenant and have accepted the invite. However, upon trying to reach the DevOps organisation, ...
Kidd_Ip
Mar 31, 2025MVP
Please try to fix bye following:
- Review Conditional Access Policies
- Go to the Azure Active Directory Admin Center.
- Navigate to Security > Conditional Access and review the policies applied to external users.
- Check if there are policies restricting access based on:
- Device compliance (e.g., requiring domain-joined devices).
- Location (e.g., only allowing access from specific IP ranges or regions).
- Application restrictions (e.g., blocking access to Azure DevOps for certain users).
- Sign-In Logs
- In the Azure AD Admin Center, go to Users > Sign-in logs.
- Look for the failed sign-in attempt for the external user and review the Conditional Access tab to identify which policy is blocking access.
- Adjust Conditional Access Policies
- If a policy is blocking access, you can:
- Add an exception for the external users or their organization.
- Temporarily relax the policy to allow their access.
- Ensure that the policy allows guest users to access Azure DevOps.
- Verify External Access Settings in Azure DevOps
- In Azure DevOps, go to Organization Settings > Policies.
- Confirm that External guest access is enabled.
- Check B2B User Configuration
- Ensure that the external users are properly added as B2B guest users in your Entra tenant.
- Verify that they have accepted the invitation and their accounts are active.
- Device State
- The error mentions that the device state is "Unregistered." If your Conditional Access policy requires registered or compliant devices, this could be the issue. You may need to adjust the policy to allow unregistered devices for external users.