What Permissions Does an Azure DevOps Analytics Extension Need? (No PAT Required)

An analytics extension for Azure DevOps Services can work with a few read-only scopes and the signed-in user's own session, so yes, there are reporting tools that need no personal access token. Before you approve one from the Marketplace, check six things: the scopes, read versus write, credentials, where work-item data goes, Services versus Server, and what the vendor stores.

The checklist

Use these questions for any analytics extension, ours included.

1. Read the scopes on the consent screen. An organisation administrator installs extensions, and the Marketplace lists the scopes each one requests before it is approved. Each scope is a kind of data the extension can reach. A sprint analytics tool has no reason to read your source code.
2. Check read versus write. Reporting only needs to read. If an analytics tool asks to write work items, ask what it writes and why. A read-only extension cannot change a state, reassign an item or edit a field, even by accident.
3. Ask what credential it needs. Tools that pull data from outside Azure DevOps need their own: a personal access token, a shared service account or a service principal. Each one has to be created, stored, rotated and revoked when someone leaves. An extension that runs under the user's own session skips that.
4. Find out where work-item data goes. Do titles, descriptions, comments or sprint contents ever reach the vendor's servers? Ask for the exceptions too: integrations, AI features and benchmarks are where data usually leaves.
5. Confirm Services or Server. Azure DevOps Services (cloud) and Azure DevOps Server (on-premises) are different products, and many extensions support only one.
6. Ask what the vendor stores. Even a tool that never sees work-item content usually keeps licence records and usage events. A good vendor lists them and says which you can switch off.

How Agile Analytics answers each one

Here is the same checklist, answered for Agile Analytics.

• Scopes. Exactly four: vso.project, vso.work, vso.graph and vso.build. No vso.code, no vso.analytics. vso.build is there for the DORA Metrics view, which reads pipelines.
• Read versus write. All four are read-only and there are no write scopes. The extension cannot modify your work items.
• Credentials. No personal access token, no service connection, no Azure Function, no database, no Power BI and no Analytics views. Every analytics view runs in the user's browser against the Azure DevOps REST API, with the session they are already signed in with. People need Project Contributor access or higher.
• Where work-item data goes. Work-item content (titles, sprint contents, PRs, code, comments, attachments) is never sent to a Baytek server. The Exec Report is built in the browser and sends nothing to Baytek.
• Services or Server. Azure DevOps Services only. Azure DevOps Server is not supported.
• What Baytek stores. Licence records, an install and heartbeat ping, pseudonymous usage events used to count active users and enforce seats (an admin can turn them off in Configuration, Privacy), opaque identity descriptors for seat holders on assigned-seat plans, and the first admin's sign-in email for trial reminders and service notices. None of it is work-item content. The privacy policy lists every item.

The exceptions, said plainly

Three features send something beyond the list above, and each is under your control.

• AGAN AI, the assistant inside the hub. When someone sends a question or asks for a stakeholder summary, the question, a fixed set of setup counts and codes and, on the views that show them, the numbers on that view with, where the view holds them, the same numbers for the previous sprint or period go to Baytek and its AI provider, Anthropic. Never work-item content, names, IDs or paths. An extension admin can turn AI answers off in Configuration, Access Control.
• GitHub Copilot AI Metrics (optional) uses a GitHub token, not an Azure DevOps one. The browser sends it only to api.github.com, never via Baytek. Teams and Slack WIP alerts likewise go straight from the browser to your webhook URL.
• Industry Benchmarks is opt-in and sends aggregate metric data.

For your security review

The no-PAT architecture page walks through each data path for a reviewer, including what the design costs, and the security page has the full table of what reaches Baytek and the control for each row.

Related: Azure DevOps analytics with no PAT required · Data & Privacy: in-app transparency

Try it

Installing starts a 30-day free trial with no credit card and no sign-up form, and everyone in the organisation has full access while it runs. Your organisation administrator can check the four scopes on the consent screen of the Marketplace listing before approving it.

Related: Install instructions