Azure devops access issue

Question

Azure devops access issue

Pieter 101

We accidentally deleted a user in our Azure Entra ID. We spotted this quickly and restored the user (from the deleted users screen). The user has/had access to our azure devops environment.

After the restoration of the user account it is visible as a user in our devops organization with the custom access right it had previously. The issue is that user can't login on azure devops. The authentication on the URL https://aex.dev.azure.com/me?mkt=en-US works. We can see the user has access to our devops org but loading the organization details keeps showing a spinning icon.
Similar issue on git, when connecting to a repo in the organization the user hits a 403 error.

It looks like something broke due to our accidental deletion and restore of the user account in Entra ID. Any thoughts on how to resolve this?

Thanks!

Siddhesh Desai 4,895 Reputation points Microsoft External Staff Moderator

2026-04-07T15:55:44.8366667+00:00

Hi @Pieter Thank you for reaching out to Microsoft Q&A.

Can you ask user to delete the browser cache and history and re-try logging into Azure DevOps Organization and see if it works?

Try to access https:// aex.dev.azure.com
Siddhesh Desai 4,895 Reputation points Microsoft External Staff Moderator

2026-04-07T16:08:45.9666667+00:00
Hi @Pieter

Thank you for reaching out to Microsoft Q&A.

When a user is deleted and later restored in Azure Entra ID, the identity object is only partially recovered from an Azure DevOps perspective. Although the user may still appear in the Azure DevOps organization with the same access level and authentication may succeed at a basic level (for example, accessing https://aex.dev.azure.com/me), Azure DevOps relies on internal identity descriptors and cached mappings for authorization. These internal identity artifacts are not fully rehydrated after an Entra ID delete-and-restore operation. As a result, the user experiences symptoms such as the organization page loading indefinitely, Git operations failing with 403 errors, and incomplete access across the organization. This is not a permissions misconfiguration or conditional access issue, but a broken identity mapping within Azure DevOps that does not self-heal automatically.

Refer below points to resolve this issue or this is the workaround

Remove and re-add the user to the Azure DevOps organization (recommended workaround)

Go to Organization Settings → Users in Azure DevOps

Completely remove the affected user from the organization

Wait for a few minutes to allow Azure DevOps identity caches to clear

Add the same user again using their Entra ID UPN

Reassign the required access level (Basic/Stakeholder) and project or group permissions This forces Azure DevOps to recreate the internal identity descriptor cleanly and resolves the issue in most cases.

Ensure the user is removed from all Azure DevOps groups before re-adding

Verify the user is removed from project-level groups and Project Collection–level groups

After removal, ask the user to sign out of all Microsoft sessions and sign back in

Re-add the user and restore group memberships as required

Create a new Entra ID user as a last resort

If removing and re-adding the restored user does not resolve the issue, create a new Entra ID user with a new UPN

Grant access to Azure DevOps and reassign permissions

This approach always resolves the issue but should be used only if the previous steps fail, as it is more disruptive.