PolicyVault for Azure DevOps: PR and Work Item Compliance

Linked isn’t the same as approved.

Azure DevOps can require a linked work item on a pull request, but it can’t check what that work item is. A pull request linked to a closed bug, an unapproved user story, or a task with empty required fields still passes. That gap shows up later as audit findings, failed compliance reviews, and manual evidence gathering.

PolicyVault adds the missing rules, using the work item queries you already know. You define what makes a work item valid as a standard Azure DevOps work item query, built and edited in the familiar Azure DevOps query editor. Use any combination of type, state, area path, iteration, tags, and custom fields such as a risk rating, a change ticket ID, or an approval flag. Every pull request is checked in real time against your query, and it can’t be completed until a linked work item matches.

Why teams choose PolicyVault

• Rules you can build in minutes. If you can write a work item query, you can write a policy. You edit queries directly in the Azure DevOps interface, without learning a new rule language or writing scripts.

• Fast start with open-source templates. Begin with a ready-made set of open-source policy templates for common compliance scenarios, then adjust them to fit your process.

• Changes take effect immediately. Every policy check runs your Azure DevOps query live, so an edited query applies to the very next pull request. Nothing needs to be synced, published, or redeployed.

• Real traceability, not just a link. Every merge maps to a work item that meets your criteria, with the data your auditors expect.

• Works with your existing policies. Keep the native “Check for linked work items” branch policy and add query-based rules on top. No pipeline changes and nothing to install.

• One policy, every repo. Label-based scopes apply your rules to the right teams, repositories, and branches across multiple Azure DevOps organizations, so you configure them once instead of repo by repo.

• Always audit-ready. A central dashboard shows policy compliance across every organization, project, and repository you manage.

Key features

• Policies defined as Azure DevOps work item queries, edited in the standard Azure DevOps interface

• Open-source template set for quick setup of common policies

• Live query evaluation: query edits apply immediately to new pull request checks

• Label-based policy scopes for flexible targeting by team, repository, or branch

• Real-time pull request validation through native Azure DevOps webhook integration

• Central dashboard for policies, scopes, and linked Azure DevOps organizations

• Multi-tenant support for managing multiple Azure DevOps organizations under one tenant

• Secure Microsoft Entra ID sign-in with tenant isolation

Who it’s for

• DevOps leads and engineering managers who need consistent pull request governance across teams

• Compliance, security, and audit teams working under SOC 2, ISO 27001, or internal SDLC controls

• Enterprises standardizing change management across many Azure DevOps organizations, projects, and repositories

Get started in minutes

Start your free 1-month trial: sign up with Microsoft Entra ID, link your Azure DevOps organization, pick a template, and enforce your first policy in under 10 minutes.