Skip to content
Latchkey

Azure Pipelines Multi-Repo Checkout Not Authorized

Checking out more than one repository requires each extra repo declared under resources.repositories, the pipeline authorized to use it, and the Build Service identity granted read on that repo. Missing any one blocks the second checkout.

What this error means

The first repo checks out fine, but the checkout: <alias> for a second repo fails with "not authorized" or a permission error. The job cannot fetch the additional repository.

Azure DevOps
##[error]Git fetch failed for repository 'tools'.
The pipeline is not authorized to use the repository, or the build service
identity lacks read permission.

Common causes

Second repo not declared or not authorized

Each additional repo must be a repository: resource and authorized for the pipeline (a protected resource). An undeclared or unauthorized repo cannot be checked out.

Build Service lacks read on the other repo

The pipeline’s Build Service identity needs Read on the second repo (especially cross-project). Without it the fetch is denied even when the resource is declared.

How to fix it

Declare and check out the second repo

Add the repository resource and reference it by alias in a checkout step.

azure-pipelines.yml
resources:
  repositories:
    - repository: tools
      type: git
      name: Platform/tools
steps:
  - checkout: self
  - checkout: tools   # alias from resources.repositories

Authorize and grant read on the other repo

  1. On first reference, approve the authorization prompt for the repo resource.
  2. Grant the Build Service identity Read on the second repo (Project Settings → Repos → Security).
  3. For cross-project repos, set the pipeline’s job authorization scope to project collection if intended.

How to prevent it

  • Declare every additional repo under resources.repositories.
  • Grant the Build Service least-privilege Read on consumed repos.
  • Give each checkout a distinct path to avoid workspace collisions.

Frequently asked questions

What causes "Multi-repo checkout denied"?
Each additional repo must be a repository: resource and authorized for the pipeline (a protected resource). An undeclared or unauthorized repo cannot be checked out.
How do I fix Multi-repo checkout denied?
Add the repository resource and reference it by alias in a checkout step.

Related guides

References

Latchkey auto-heals failures like this one - detected, fixed, and retried without you. Start free → 30-day trial · No credit card