Setup pr agent on Azure DevOps with managed identity

August 22, 2026

Setup pr agent on Azure DevOps with managed identity

22 Aug 2026

I tried out to follow the PR Agent Azure installation. Normally you would use managed identity in order to avoid running things in user account, so I after a few sessions of edit, Claude, ChatGPT and observe the results we got a setup that deviated slightly from the documentation:

 stages:
 - stage: pr_agent
   displayName: 'PR Agent Stage'
+  condition: eq(variables['Build.Reason'], 'PullRequest')
+  dependsOn: []
   jobs:
   - job: pr_agent_job
     displayName: 'PR Agent Job'
     pool:
      vmImage: 'ubuntu-latest'
     container:
       image: pragent/pr-agent:latest
       options: --entrypoint ""
     variables:
      - group: pr_agent
     steps:
     - script: |
         ...unchanged...
       env:
-        azure_devops__pat: $(azure_devops_pat)
-        openai__key: $(OPENAI_KEY)
+        openai__key: $(vg-pr-agent-OPENAI_KEY)
+        AZURE_CLIENT_ID: $(vg-pr-agent-AZURE_CLIENT_ID)
+        AZURE_CLIENT_SECRET: $(vg-pr-agent-AZURE_CLIENT_SECRET)
+        AZURE_TENANT_ID: $(vg-pr-agent-AZURE_TENANT_ID)
       displayName: 'Run PR-Agent'

Note the addition to only trigger on pull request and avoid depending on other stages in the pipeline.

You have to setup an Enterprise Application, create a secret and add that Enterprise Application account to the Azure DevOps organization with contributor access.

Comments

Do you want to send a comment or give me a hint about any issues with a blog post: Open up an issue on GitHub.

Do you want to fix an error or add a comment published on the blog? You can do a fork of this post and do a pull request on github.

Setup pr agent on Azure DevOps with managed identity

Tags

Comments