Skip to content

installation-guide.md

Latest commit

 

History

History
202 lines (157 loc) · 6.83 KB

installation-guide.md

File metadata and controls

202 lines (157 loc) · 6.83 KB

Azure DevOps Server 2020 with Azure Application Proxy - Installation Guide

Overview

This guide walks you through the complete installation and initial setup of Azure DevOps Server 2020 with Azure Application Proxy integration.

Prerequisites

Azure Requirements

  • Active Azure subscription
  • Azure Active Directory tenant
  • Global Administrator permissions in Azure AD
  • Azure Application Proxy license (included with Azure AD Premium P1/P2)

On-Premises Requirements

  • Azure DevOps Server 2020 installed and configured
  • Windows Server 2016 or later for Application Proxy Connector
  • Internet connectivity from connector server
  • SSL certificate for external domain
  • Domain Administrator privileges

Step 1: Install Azure Application Proxy Connector

Download and Install Connector

  1. Sign in to the Azure portal as a Global Administrator
  2. Navigate to Azure Active Directory > Application proxy
  3. Download the Application Proxy Connector Service
  4. Run the installer on your on-premises server (preferably not on the Azure DevOps Server itself)

Register the Connector

  1. During installation, sign in with your Azure AD Global Administrator account
  2. The connector will automatically register with your Azure AD tenant
  3. Verify the connector appears as "Active" in the Azure portal

Step 2: Configure Azure Application Proxy Application

Create Application Proxy Application

  1. In Azure portal, go to Azure Active Directory > Enterprise applications
  2. Click New application > On-premises application
  3. Configure the following settings:
    • Name: Azure DevOps Server 2020
    • Internal URL: https://your-devops-server.local:8080/tfs/
    • External URL: https://devops-external.yourdomain.com/
    • Pre Authentication: Azure Active Directory
    • Connector Group: Default (or create specific group)

SSL Configuration

  1. Upload your SSL certificate in the Azure portal
  2. Ensure the certificate matches your external domain
  3. Configure certificate binding in IIS on Azure DevOps Server

Step 3: Configure Azure DevOps Server

Update Server URLs

  1. Open Azure DevOps Server Administration Console
  2. Navigate to Application Tier > Change URLs
  3. Update the Notification URL to match your external URL
  4. Update any webhook URLs to use the external domain

Configure Authentication

  1. In Azure DevOps Server Admin Console, go to Access Levels
  2. Ensure Azure AD users have appropriate access levels
  3. Configure group membership synchronization if needed

Step 4: Configure Service Principal Names (SPNs)

Service Principal Names are required for Kerberos authentication with Azure Application Proxy.

Automatic SPN Configuration

  1. Using PowerShell Script (Recommended)

    # Configure SPNs for computer account
./scripts/powershell/configure-spn.ps1 `
    -ServiceAccount "DOMAIN\COMPUTERNAME$" `
    -ExternalDomain "devops.company.com" `
    -InternalDomain "tfsserver.company.local" `
    -Ports @(80, 443) `
    -ConfigureDelegation `
    -TestSPN

# Configure SPNs for dedicated service account
./scripts/powershell/configure-spn.ps1 `
    -ServiceAccount "DOMAIN\svc-tfs-web" `
    -ExternalDomain "devops.company.com" `
    -InternalDomain "tfsserver.company.local" `
    -Ports @(8080, 443) `
    -TfsServiceAccount "DOMAIN\svc-tfs-app" `
    -ConfigureDelegation `
    -TestSPN

  2. Using Batch Script (Alternative)

    # Run interactive configuration
scripts\configure-spn.bat

# Or with parameters
scripts\configure-spn.bat "DOMAIN\ServiceAccount" "external.domain.com" "internal.domain.local" "80 443" "n" "y"

Manual SPN Configuration

If you prefer manual configuration:

  1. Check existing SPNs

    setspn -L DOMAIN\ServiceAccount

  2. Add required SPNs

    # For external domain (Application Proxy URL)
setspn -A HTTP/devops.company.com DOMAIN\ServiceAccount
setspn -A HTTP/devops.company.com:443 DOMAIN\ServiceAccount

# For internal domain (TFS server)
setspn -A HTTP/tfsserver.company.local DOMAIN\ServiceAccount
setspn -A HTTP/tfsserver.company.local:8080 DOMAIN\ServiceAccount

  3. Verify SPN registration

    setspn -Q HTTP/devops.company.com

Service Account Considerations

  • Computer Account: Use DOMAIN\COMPUTERNAME$ for simplicity
  • Dedicated Service Account: Use DOMAIN\svc-account-name for better security
  • Network Service: Not recommended for production environments

Step 5: Configure DNS and Networking

DNS Configuration

  1. Create a CNAME record pointing your external domain to the Azure Application Proxy service
  2. Ensure internal DNS resolves the Azure DevOps Server correctly
  3. Test DNS resolution from both internal and external networks

Firewall Configuration

  • Outbound from Connector Server:
    • HTTPS (443) to Azure endpoints
    • HTTP (80) for certificate validation
  • Inbound to Azure DevOps Server:
    • HTTPS (443/8080) from connector server
    • Standard Azure DevOps ports

Step 6: Test Configuration

Internal Testing

  1. Verify Azure DevOps Server is accessible internally
  2. Test user authentication with domain accounts
  3. Verify all features work correctly

External Testing

  1. Access Azure DevOps using the external URL
  2. Test Azure AD authentication
  3. Verify Git operations work externally
  4. Test Visual Studio connectivity

Step 7: User Management

Assign Users to Application

  1. In Azure portal, go to your Application Proxy application
  2. Navigate to Users and groups
  3. Assign appropriate users or groups
  4. Configure user access policies

Configure Single Sign-On

  1. Set up SAML-based SSO if required
  2. Test SSO functionality
  3. Configure any custom claims needed

Troubleshooting Installation Issues

Common Issues

  • Connector not appearing as Active: Check internet connectivity and firewall rules
  • Authentication failures: Verify Azure AD configuration and user assignments
  • SSL certificate errors: Ensure certificate is properly installed and matches domain
  • Internal URL not accessible: Check Azure DevOps Server configuration and networking

Validation Steps

  1. Verify connector status in Azure portal
  2. Test internal URL accessibility from connector server
  3. Validate SSL certificate chain
  4. Check Azure AD user assignments
  5. Test external URL accessibility

Next Steps

After successful installation:

  1. Follow the Configuration Guide for advanced settings
  2. Review Security Considerations
  3. Set up monitoring and logging
  4. Train users on external access procedures

Support Resources

  • Azure Application Proxy documentation
  • Azure DevOps Server documentation
  • Azure AD troubleshooting guides
  • Microsoft Support if issues persist