Azure Pipelines Multi-Repo Checkout Not Authorized
Checking out more than one repository requires each extra repo declared under resources.repositories, the pipeline authorized to use it, and the Build Service identity granted read on that repo. Missing any one blocks the second checkout.
What this error means
The first repo checks out fine, but the checkout: <alias> for a second repo fails with "not authorized" or a permission error. The job cannot fetch the additional repository.
##[error]Git fetch failed for repository 'tools'.
The pipeline is not authorized to use the repository, or the build service
identity lacks read permission.Common causes
Second repo not declared or not authorized
Each additional repo must be a repository: resource and authorized for the pipeline (a protected resource). An undeclared or unauthorized repo cannot be checked out.
Build Service lacks read on the other repo
The pipeline’s Build Service identity needs Read on the second repo (especially cross-project). Without it the fetch is denied even when the resource is declared.
How to fix it
Declare and check out the second repo
Add the repository resource and reference it by alias in a checkout step.
resources:
repositories:
- repository: tools
type: git
name: Platform/tools
steps:
- checkout: self
- checkout: tools # alias from resources.repositoriesAuthorize and grant read on the other repo
- On first reference, approve the authorization prompt for the repo resource.
- Grant the Build Service identity Read on the second repo (Project Settings → Repos → Security).
- For cross-project repos, set the pipeline’s job authorization scope to project collection if intended.
How to prevent it
- Declare every additional repo under
resources.repositories. - Grant the Build Service least-privilege Read on consumed repos.
- Give each checkout a distinct
pathto avoid workspace collisions.