The Best Way to Do Code Review on Azure DevOps (With Pipelines, Policies & AI)
AI CODE REVIEW
Aug 10, 2025
Introduction: Azure DevOps Deserves Better Reviews
Most teams treat code reviews like a checklist.
Push code. Open PR. Wait for someone to click Approve. Done.
But that’s not what great teams do.
Great teams use reviews to share context, spot risks early, and keep code maintainable - not just mergeable.
They treat PRs as places for clarity, not chaos.
And if you’re on Azure DevOps, you already have the tools to make that happen.
You’ve got pull requests that link to tasks, pipelines that test your code before anyone even sees it, and policies that enforce real standards.
This isn’t just “how to open a PR”.
It’s a complete, hands-on guide to doing reviews that are fast, focused, and actually helpful - built for how Azure DevOps works today.
What Makes Azure DevOps Code Reviews Unique

Azure DevOps isn’t just Git with a Microsoft wrapper.
It’s one of the most structured, policy-driven review platforms out there - and that’s a good thing.
Here’s what makes it stand out:
Deep Integration with Boards, Pipelines, and Policies
Every PR can be linked to one or more work items in Azure Boards - so reviewers aren’t guessing why something changed.
Pipelines run automatically, giving a full pass/fail signal before anyone reviews manually.
Real Enforcement with Branch Policies
You can require:
A minimum number of reviewers
Linked work items (no PR without a purpose)
Successful builds before merge
Specific people to review changes in certain files (like
/security/
or/infra/
)
This turns “optional” review hygiene into something your team can count on.
Extensible PR Statuses
External tools - like security scanners or custom CI checks - can set status checks on PRs.
If they fail, the PR won’t merge.
This makes things like SAST, code coverage, or license compliance enforceable - not just suggestible.
Built-in Merge Strategies and Automation
Azure DevOps supports:
Auto-complete (merge when ready)
Squash merges or full-history merges
Delete source branch after merge
And it can even close linked work items automatically
It Plays Well With Your Whole Stack
From REST APIs to dashboard widgets to integration with Microsoft Teams or Excel (yes, really), Azure DevOps is extensible if you want it to be - and easy to use if you don’t.
Most tools give you a way to comment on code.
Azure DevOps gives you the structure to do it at scale - consistently, securely, and with context.
Before You Open a PR: Self-Review Comes First
A Pull Request (PR) is how you ask your team to review and merge code into a shared branch - usually main
or dev
.
In GitHub, you open a PR.
In GitLab, it’s called a Merge Request.
In Azure DevOps, it’s a PR inside Azure Repos, tightly connected to your work items, pipelines, and branch policies.
But no matter what platform you're on, the moment you open a PR, you're asking for time and attention.
So, before anyone else looks at your code, you should too.
If you wouldn’t merge your own PR without hesitation, it’s not ready.
Self-Review Checklist
Reread every change
Don’t skim. Pretend you’re reviewing someone else’s code. Spot awkward logic, confusing names, or complexity before anyone else has to.Run tests locally
Don’t rely only on CI. Make sure it works in your environment first.Refactor noisy diffs
Did you change formatting, reorder imports, or leave commented-out code? Clean it up so reviewers focus on what matters.Clean up debug logs and TODOs
Loggingconsole.log(‘here’)
is not a debugging strategy. And TODOs without action are just landmines.Keep it focused
One feature or one fix per PR. No bundling bugfixes, refactors, and unrelated tweaks together.Link your work items
In Azure DevOps, this means adding the relevant task or story from Boards so reviewers understand the why behind your change.
Want to Try This Yourself?
When we wrote this guide, we wanted to do what we did in our GitLab and Bitbucket blogs:
Set up a public demo repo where you could fork the project, raise a PR, and follow along step by step.
So we tried that.
Turns out…Azure DevOps doesn’t really want you doing that anymore.
It doesn't support public forking, and while public projects technically exist, they’re hidden behind limited settings. Even Microsoft now nudges you toward GitHub if you want open collaboration.
No worries, we thought - we’ll just have readers email us and we’ll manually add them as contributors.
That would’ve worked…until we eventually hit user #6.
Azure DevOps only allows the first 5 contributors to be free per organization. After that, it’s $6 per user per month - even if they’re just exploring.
So here's the best and most sustainable workaround:
Try This in Your Own Azure DevOps Project
Create a free Azure DevOps account
Set up a private repo under your own organization
Follow along with this guide, step by step:
Create a feature branch
Make a small change
Open a PR
Tag yourself as a reviewer
Test out comments, voting, merge strategies, and auto-complete
It’s free, fast, and gives you a real feel for how Azure DevOps PRs actually work.
No access requests, no waiting, no surprises. Just your own sandbox and this guide as your playbook.
Self-review isn’t busywork - it’s what earns trust.
The better your PR is when it’s opened, the faster and more useful the review will be.
Creating a Quality PR in Azure DevOps (Set the Stage for a Great Review)
The moment you open a PR, you’re not just asking for code to be merged - you’re asking for your team’s time, attention, and trust.
That means every part of your PR - from the title to the diff - should make things easier for your reviewers.
Clean, clear PRs get reviewed faster and better. Sloppy ones sit ignored.
Here’s how to open a pull request the right way in Azure DevOps - and how to make it review-ready from line 1.
Step 1: Make Your Changes - But in a Branch
Once you're inside your project (your own or someone else's):
Click Repos from the left sidebar

Once inside, more options will appear under “Repos”

From here, you can:
Clone the repo and edit locally
Use the in-browser editor
Work directly in the web UI
Best Practice: Always create a new branch - don’t push to main
.
Whether you're fixing a typo or building a feature, separating your work makes the diff cleaner and the merge safer.
Step 2: Commit Your Changes
Once your changes are committed, Azure DevOps might suggest:
“You updated branch-name
X minutes ago. Create a pull request?”

If it does, great - click it.
If not:
Head to Pull Requests in the sidebar
Click the “New Pull Request” button on the top right

Step 3: Choose the Right Branches
At the top of the PR form:
Select your source branch (the one with your changes)
Choose your target branch (usually
main
,dev
, or a release branch)

Best Practice: Double-check this - especially if you forked the repo.
If you're in a fork, you’ll also need to select source/destination repos.
Targeting the wrong branch is how last-minute bugs sneak into prod.
Step 4: Title and Description - Say What Matters
This is where your PR becomes readable. Don’t waste it.
Title: Clear, present-tense, and concise
e.g. Fix login redirect bug on session timeout
Description: Explain the why, not just the what
What problem does this solve? Any tradeoffs? Edge cases?
Azure offers a button to auto-add commit messages - useful, but don’t let that replace actual context.
Pro Tip: Use the little buttons below the description box.
You can add:
Mentions (
@username
)Linked work items (
#123
) (more on this later)File attachments
Checklists
Code formatting (bold/italic/code format text, insert links)

Always try to include relevant images and file attachments.
Here’s a sample PR in markdown format you can use for your own PR:
Step 5: Assign the Right Reviewers
Below the description, you’ll see:
Reviewers: Add relevant people - not just whoever’s online
Add Required reviewers: If your repo allows it, assign them explicitly
Work items to link: Connect your Azure Boards task or bugs (we will discuss work items in proper detail later in the blog)
Tags: Optional - but helpful for filtering or categorizing. Use short and descriptive tags.

Best Practice: Assign teammates who know the code area or can spot issues you might miss.
This isn’t about hierarchy - it’s about context.
Step 6: Draft or Final?
If the code isn’t quite ready, but you want early feedback - mark it as a draft PR.
That tells reviewers: “Don’t merge this yet, but feel free to comment”.
Use it when:
CI is still running
You’re waiting on another branch
You want help naming or refactoring
Step 7: Pre-Review the Diff (Yes, Yourself)
Before you hit "Create":
Click the Files tab to view all changes line-by-line

Switch to Commits to see the full commit history in this PR
Best Practice: Read your own diff before asking someone else to.
This helps you catch stray changes, missing test coverage, or noisy commits.
Step 8: Create the PR (And Make It Count)
When you’re confident:
Click “Create” or “Create as draft”
Once open, you can:
Add follow-up comments
Edit reviewers, linked work items, or tags
Track the status of builds, votes, and tasks

Here, we have added a required reviewer after opening the pull request. We can see how Azure tracks PR activity and changes in it:

A great PR respects everyone’s time.
It makes the changes understandable, the purpose clear, and the review focused.
Reviewing a PR: How to Actually Help (Not Just Approve and Bounce)
The dev wrote the code. They tested it, pushed it, and wrote the PR.
Now they’re waiting on you.
Your job isn’t to nitpick quotes or demand a semicolon.
It’s to help them ship something safer, clearer, and stronger - without dragging it out.
Let’s walk through how to do that well - and how Azure DevOps supports you when you care.
First: Check Why This PR Exists
Head to your project homepage
You’ll see how many PRs are open in ‘Project stats’

Click Repo → Pull Requests in the sidebar
Filter by Mine, Active, Completed, or Abandoned
If you see a small “Required” tag, that means your approval is needed.

Don’t Open Files Yet. Read the Story First.
Every PR opens to the Overview tab.
This is where you get the context - the “why”, not just the “what”.
Read the title and description
Click the linked work item to understand what it’s trying to fix (we have explained work items in this section: Advanced Code Review: Automate What Humans Shouldn’t Be Doing)
Check the tags, attached screenshots, logs, whatever’s there

If anything’s unclear: Ask. Don’t guess.
Don’t start scanning code without knowing what it’s supposed to do.
Leave Feedback That’s Actually Helpful
Under the description, drop comments with full Markdown formatting:
>
Quote lines from the PRSuggest changes, don’t just say “fix this”
Use buttons to @mention people, link work items, create checklists, or attach files

You can also:
Convert comments into tasks
Change their status: Active → Resolved → Won’t Fix → Closed
Sort by active/resolved to keep the thread clean
Best Practice: Don’t leave vague stuff like “this needs cleanup”.
Instead:
Go to “Files” Tab - That’s Where the Real Review Happens
This is where you review the actual code diff:
Inline or side-by-side view
Comment on specific lines
(Notice those little icons below the comment section? I was talking about them above.)
Use preview mode for frontend or structured file changes

What to focus on:
Business logic - does it make sense?
Edge cases - anything that might silently break?
Security holes - anything that trusts user input?
Side effects - does it touch the global state, mutate things unexpectedly?
Performance - any unnecessary calls or big loops?
Naming - would someone else understand this in 6 weeks?
Don’t sweat:
Semi-colons
“I prefer tabs.”
Style rules that linters can enforce
Go to “Updates” & “Commits” for the Backstory
Updates tab → See changes to the PR title, reviewers, auto-complete settings
Commits tab → Understand the commit trail
Best Practice: If the commit messages are junk (e.g., try again
, fix issue
, final
), ask for a squash and rewrite.
Good commits make future debugging 10x easier.
Time to Vote
Click the dropdown next to Approve, and you’ll get:

Approve - You’re good with this
Approve with Suggestions - Mergeable, but FYI on some improvements
Wait for Author - Needs work before merge
Reject - Only use if it's seriously broken or wrong direction
Use “Approve with Suggestions” generously - it helps move things forward while still giving good input.
Use Auto-Complete (Azure’s Cleanest Feature)
Click the dropdown next to Set Auto-Complete

Once set, Azure will merge this PR automatically when:
All reviewers approve
All tasks are resolved
Pipelines (CI) pass
You can even configure:
Merge Type

Merge (no fast-forward) → keeps full history
Creates a new merge commit that brings the branch into the target - full history preserved.Squash → 1 commit, clean tree
Combines all commits into one clean commit on the target branch.Rebase and fast-forward → linear, no merge commit
Rewrites history so the branch appears as if it were built directly on the target. No merge commit is created.Semi-linear → rebase + merge node
Rebases the source onto the target, then creates a merge commit, combining the benefits of rebase and explicit history tracking.
Post-Merge Settings

Complete linked work items
Delete branch
Customize commit message
Best Practice: Turn this on early in your review - so it merges automatically once everything’s ready.
After Merge: Now What?
Once your PR is merged, Azure shows this final confirmation screen - but what are those two new buttons?

Cherry-pick
Want to apply this change to another branch (like a hotfix or release branch)?
Click Cherry-pick, choose the target branch, and Azure will open a new PR with the same change.
Revert
Need to undo a merged PR (without rewriting history)?
Click Revert and Azure will auto-generate a PR that reverts the changes — clean and traceable.
These options make it easy to manage mistakes or backport fixes, without fussing with Git CLI.
What a Great Reviewer Actually Does
You're not here to find typos.
You’re here to help the team avoid fire drills later.
Review Checklist
Did I understand what this PR is trying to solve?
Did I check for regressions, weird edge cases, risky assumptions?
Are tests in place or updated?
Will this confuse someone next week?
Did I leave clear, kind, actionable feedback?
TL;DR - Reviewing Is a Skill. Treat It Like One.
A great PR review:
Builds trust
Catches real bugs
Improves the author’s confidence
Reduces long-term tech debt
“You don’t need to approve everything.
You just need to help the team ship the right things”.
Enforcing Quality with Branch Policies (The Right Way)
A PR isn’t just a conversation - it’s also a gate. And Azure DevOps gives you powerful controls to make sure no PR sneaks through without quality checks.
Whether it’s enforcing reviews, blocking merges with failing pipelines, or auto-including the right reviewers, branch policies are how your team turns good habits into defaults.
What You Can Enforce
These are the core policies available in Azure DevOps - each helping enforce a different layer of review quality:
Minimum number of reviewers
Make sure every PR has 1–2 real reviews before it hits main.
Required reviewers
Assign specific people (or groups) based on file paths - perfect for infra, auth, or sensitive domains.
Linked work items
Don’t let devs push code without context - enforce connection to Azure Boards tasks, bugs, or stories.
Successful builds
Hook into Azure Pipelines - block merges unless your build/test jobs pass.
Resolved comments only
Stop merges until every open thread or task is closed.
Branch up-to-date with target (optional)
Prevents weird rebase/merge conflicts - ensures changes are tested against the latest code.
Status checks from external services
Require success from tools like CodeANT, Snyk, or coverage analyzers before merging.
How to Set This Up
Go to your Project Settings
Under Repos → Repositories, select your repo
Scroll to the bottom, click on the desired branch under ‘Branch Policies’

You’ll see these main tabs:
1. Branch Policies (the core rules)
Require a minimum number of reviewers
Usually 1 or 2.
Best Practice: Don’t allow solo reviews.Check for linked work items
Enforces traceability - no mystery PRs.Check for comment resolution
Prevents "merge and forget" by blocking unresolved discussions.Limit merge types
Control history quality: allow only squash or rebase if your team wants a clean log.

2. Build Validation
This is where you plug in your Azure Pipelines:
Build pipeline: select your
.azure-pipelines.yml
Trigger: automatic (on push) or manual
Policy requirement: required or optional
Build expiration: choose when the build becomes stale (immediate, 12h, never)

Pro tip: Choose “Required” and set build to expire if the target branch (main
) has moved - ensures up-to-date testing.
3. Status Checks
Use this if you want external tools to block or approve merges.
Define the status name (e.g.,
CodeANT/SAST
,SonarCloud/Coverage
)Choose if it’s required or optional
Limit who can post the status (e.g., only a trusted integration)
Set reset conditions (e.g., reset status when new commits are pushed)

4. Automatically Included Reviewers
Assign code owners based on paths:
Add one or more users/groups
Make their approval optional or required
Scope them to specific folders (e.g.,
src/db/
,terraform/
)Decide if PR authors can approve their own changes
(usually off for shared repos)

Best Practice: Use this to avoid “PR roulette” - always loop in the right people for the right files.
Tie It All Together with Auto-Complete
Once policies are in place, Set Auto-Complete becomes super powerful:
Azure will only merge the PR when:
All reviews are done
All tasks are resolved
All pipelines pass
All statuses are green
(Optionally) source branch is up-to-date
Branch policies aren’t bureaucracy.
They’re just your best reviewer - never tired, never rushed, never skipping steps.
Use them to automate consistency, reduce human error, and focus your team’s time on what matters: code quality and collaboration.
Ready to automate even more?
Advanced Code Review: Automate What Humans Shouldn’t Be Doing
Not every part of a code review needs a human.
In fact, some parts shouldn’t be reviewed by a human at all.
Formatting? Linting? Forgotten imports? Outdated dependencies?
You don’t need your smartest dev commenting “pls run Prettier”.
This is where Azure Pipelines shine - by shifting review left, so most issues are caught before anyone even clicks “View Pull Request”.
What Azure Pipelines Can Handle Automatically
Once configured, Azure Pipelines can run every time a PR is opened or updated - pre-merge checks that give reviewers a clean, tested foundation.
Here’s what you can and should automate:
Linting
Catch style issues early:
JavaScript/TypeScript →
eslint
Python →
flake8
,pylint
Java →
checkstyle
Tests
Run your unit, integration, or end-to-end test suite - and make sure nothing’s broken.
Formatting
Auto-check that code is properly formatted (black
, prettier
, clang-format
)
Security Scans
Scan for known vulnerabilities or secrets:
npm audit
,pip-audit
,bandit
,snyk
Static Analysis
Check for dead code, risky patterns, and complexity issues before the PR hits human eyes.
Two Ways to Set Up Azure Pipelines
1. Use a .azure-pipelines.yml
file (recommended for teams)
Here’s a sample for a Node + Python project:
This runs on every PR and covers:
Dependency installation
Linting
Testing
Security scanning
Customize it for your stack (Java, Go, .NET, etc.)
2. Set up a Pipeline via Azure DevOps UI
If you’re not ready to write YAML yet, Azure DevOps helps you get started:
Go to your project
Click Pipelines → New Pipeline
Choose your repo (e.g., Azure Repos Git or GitHub)
Select a starter template (Node, Python, .NET, etc.)
Review and customize the YAML it generates
Commit the pipeline file to your repo

Lock It In with Policies
No need to repeat steps here - just know:
Set your pipeline as required in Build Validation.
And status checks from other tools (like CodeANT, SonarQube, Snyk) in Status Checks.
No green check? No merge.
Let’s Talk About Work Items (Properly, Now)
Work items are a core part of Azure DevOps - and code reviews are stronger when they’re connected to actual project work.
A work item can be:
A User Story
A Task
A Bug
A Feature, Epic, or any custom type
When you link a PR to a work item, it gives reviewers context:
Why this code change exists
Who requested it
What sprint or objective it is tied to
You can link work items when:
Creating or editing a PR
Mentioning them in comments with
#<work item number>
Using the "Work items to link" section in the PR sidebar
How to Create a Work Item
Go to the Boards section in Azure DevOps (sidebar)
Click New Work Item → [Choose type]
Fill in the title, assign it, add tags, priority, etc.
Save

Once created, every work item gets a unique ID (e.g., #245
) — which can be referenced in PRs, commits, and comments.
How to Link a Work Item to a PR
We’ve already been through this: Just to reiterate, you can link a work item when creating or editing a PR:
In the PR form, scroll down to Work items to link
Use the search to find the correct task/bug/story
Select it → it’ll show up below your PR description
You can also mention the work item using #<ID>
in:
The PR title or description
A comment
A commit message
Azure DevOps will automatically create a backlink between the PR and the work item.
Let your CI catch flaky tests, formatting issues, and insecure code.
Let your reviewers focus on what really matters: logic, architecture, and clarity.
Supercharge Reviews with CodeANT for Azure DevOps
By now, you know what a great PR review looks like.
But here’s the truth:
Even the best reviewers miss things.
Even the most disciplined teams get busy.
That’s where CodeANT comes in.
It doesn’t replace human judgment - it supports it.
By handling the repetitive, the invisible, and the security-critical.
Right inside your Azure DevOps PRs.

What CodeANT Does for You
Once installed, CodeANT reviews every PR - instantly.
No delays. No skipped checks. Just helpful, high-signal feedback.
Summarizes the PR in plain English
→ Understand what changed and why in seconds.Leaves inline comments with one-click suggestions
→ Fix bugs, clean up dead code, or refactor - right in the PR.Flags logic bugs, missing tests, duplicate blocks, risky patterns
→ Across 30+ languages, with deep context awareness.Runs security and compliance scans
→ Secrets, misconfigurations, OWASP issues, vulnerable dependencies - blocked before merge.Supports your team’s custom rules
→ Like “all public methods need XML docs” or “flag non-async DB calls”.Generates audit-ready reports (SOC2, HIPAA, ISO)
→ For teams with compliance needs or enterprise policies.Integrates with Azure Pipelines + Status Checks
→ Acts as a quality gate - no green status = no merge.Works right inside the Azure DevOps UI
→ Zero context switching. Just open a PR and you’ll see it in action.

🚀 Why Teams Use It
Because smart teams know:
Linting ≠ logic review
CI ≠ code clarity
Manual review ≠ consistency
CodeANT catches what others miss. And it explains why - clearly.
It helps your junior devs learn.
Your senior devs save time.
And your codebase stays clean, secure, and review-ready.
CodeANT doesn’t replace reviewers. It raises their floor.
Use it to automate the repetitive, surface the hidden, and focus your team on the feedback that actually matters.
You’ve already learned how to review well in Azure DevOps.
Now let CodeANT help you do it at scale.
Keep PRs Small, Scoped, and Clear
Big PRs are like big meetings: noisy, hard to follow, and slow to move.
If you want better, faster code reviews - start with smaller PRs.
Here’s what that looks like:
Stick to <300 lines changed
More than that? It’s probably doing too much.One purpose per PR
Pick one: a feature, a bugfix, a refactor - not all three.Avoid mixing concerns
If your PR adds tests and renames files, and fixes a bug - split it.
Different changes deserve their own space to breathe.Use PR templates
They help enforce structure and remind you of what belongs.
Pro tip: The smaller your PR, the more likely it is to get reviewed quickly - and correctly.
Final Checks Before You Merge
Before you smash that merge button - pause.
Here’s your pre-merge checklist:
All comments resolved
No lingering feedback? Cool.All tasks completed
Azure lets you turn comments into tasks - finish them before merging.All builds & policies passed
Pipelines, security checks, status gates - all green?Branch is up to date
Avoid last-minute merge conflicts by syncing with the target.Merge strategy selected
Choose one based on your team’s policy:Squash → one commit, clean history
Merge commit → full history, detailed
Rebase & fast-forward → linear, no merge bubbles
Auto-complete enabled
Let Azure handle the merge once everything passes.Delete the source branch
Keep your repo tidy - don’t leave dead branches behind.
PR Author’s Final Checklist
Before you hand off your PR for review - or merge it yourself - run this checklist:
You can paste this directly into your PR description or template - it keeps everyone accountable and consistent.
Wrap-Up: Good Reviews Build Great Teams
Azure gives you the structure.
Pipelines give you the automation.
CodeANT gives you the intelligence.
But you - you bring the clarity.
At the end of the day, the best reviews don’t just ship code.
They teach, protect, and scale trust across your team.
Every pull request is an opportunity -
To spot what’s broken,
To explain what’s unclear,
To make one another better.
So review like it matters.
Because it does.