{"meta":{"title":"Manage access","intro":"Set up the required access for migrating from Azure DevOps to GitHub.","product":"Migrations","breadcrumbs":[{"href":"/en/migrations","title":"Migrations"},{"href":"/en/migrations/ado","title":"Migrate from Azure DevOps"},{"href":"/en/migrations/ado/manage-access","title":"2. Manage access"}],"documentType":"article"},"body":"# Manage access\n\nSet up the required access for migrating from Azure DevOps to GitHub.\n\nTo migrate repositories from Azure DevOps to GitHub, you need sufficient access to the **source** (an organization on Azure DevOps) and the **destination** (an organization on GitHub). After you complete the steps in this article, your access and permissions will ready for your migration.\n\n## Decide who will perform the migration\n\nIf the person who will perform the migration is **not** a GitHub organization owner, a GitHub organization owner must first grant them the migrator role.\n\n* If you're a GitHub organization owner, and intend to perform the migration yourself, you can continue reading this guide.\n* If you wish to assign the migrator role to someone else, do that now. Then, the migrator should perform the rest of the steps in these guides. See [Granting the migrator role](/en/migrations/ado/granting-the-migrator-role).\n\n## Create a personal access token (classic) on GitHub\n\nNext, you will need to create a personal access token (classic) which the ADO2GH extension of the GitHub CLI will use to communicate with GitHub. The scopes that are required for your GitHub personal access token (classic) depend on your role and the task you want to complete.\n\n> \\[!NOTE]\n> You can only use a personal access token (classic), not a fine-grained personal access token. This means that you cannot use GitHub Enterprise Importer if your organization uses the \"Restrict personal access tokens (classic) from accessing your organizations\" policy. For more information, see [Enforcing policies for personal access tokens in your enterprise](/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-personal-access-tokens-in-your-enterprise#restricting-access-by-personal-access-tokens).\n\n| Task                                                      | Organization owner              | Migrator                                                                                                                                                                                                                             |\n| --------------------------------------------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| Assigning the migrator role for repository migrations     | `admin:org`                     | <svg version=\"1.1\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\" class=\"octicon octicon-dash\" aria-label=\"Not applicable\" role=\"img\"><path d=\"M2 7.75A.75.75 0 0 1 2.75 7h10a.75.75 0 0 1 0 1.5h-10A.75.75 0 0 1 2 7.75Z\"></path></svg> |\n| Running a repository migration (destination organization) | `repo`, `workflow`, `admin:org` | `repo`, `workflow`, `read:org`                                                                                                                                                                                                       |\n| Downloading a migration log                               | `repo`, `workflow`, `admin:org` | `repo`, `workflow`, `read:org`                                                                                                                                                                                                       |\n| Reclaiming mannequins                                     | `repo`, `workflow`, `admin:org` | <svg version=\"1.1\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\" class=\"octicon octicon-dash\" aria-label=\"Not applicable\" role=\"img\"><path d=\"M2 7.75A.75.75 0 0 1 2.75 7h10a.75.75 0 0 1 0 1.5h-10A.75.75 0 0 1 2 7.75Z\"></path></svg> |\n\nTo learn how to create the token, see [Managing your personal access tokens](/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic).\n\n## Create a Personal access token on Azure\n\nYour Azure DevOps personal access token must have `work item (read)`, `code (read)`, and `identity (read)` scopes.\n\nWe recommend that you grant full access to your personal access token so you can use the `inventory-report` flag in phase 4.\n\nIf you want to migrate from multiple organizations, allow the personal access token to access all accessible organizations.\n\nSee [Use personal access tokens](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops\\&tabs=preview-page#create-a-pat) in Microsoft Docs.\n\n## Configure IP allow lists on GitHub\n\nIf you use GitHub's IP allow list feature, you must add the GitHub IP ranges below to the allow list for the source and/or destination organizations.\n\nIf your destination organization is on GitHub.com, you will need to allow the following IP addresses:\n\n* 192.30.252.0/22\n* 185.199.108.0/22\n* 140.82.112.0/20\n* 143.55.64.0/20\n* 135.234.59.224/28 (added July 28, 2025)\n* 2a0a:a440::/29\n* 2606:50c0::/32\n* 20.99.172.64/28 (added July 28, 2025)\n\nSee [Managing allowed IP addresses for your organization](/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization) and [Restricting network traffic to your enterprise with an IP allow list](/en/enterprise-cloud@latest/admin/configuring-settings/hardening-security-for-your-enterprise/restricting-network-traffic-to-your-enterprise-with-an-ip-allow-list).\n\n## Temporarily configure your identity provider's (IdP) restrictions\n\nIf you use your IdP's IP allow list (such as Azure CAP) to restrict access to your enterprise on GitHub, you should disable these restrictions in your enterprise account settings until after your migration is complete.\n\n## Allow migrations to bypass repository rulesets\n\nIf the destination organization or enterprise has rulesets enabled, the migrated repository's history may violate those rules. To allow the migration without disabling your rulesets, add \"Repository migrations\" to the bypass list for each applicable ruleset.  This bypass applies only during the migration. Once complete, rulesets will be enforced on all new contributions.\n\nTo configure the bypass:\n\n1. Navigate to each enterprise or organization ruleset.\n2. In the \"Bypass list\" section, click **Add bypass**.\n3. Select **Repository migrations**.\n\nFor more information, see [Creating rulesets for repositories in your organization](/en/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization) and [Setting ruleset bypasses for repository migrations](/en/enterprise-cloud@latest/migrations/troubleshooting/setting-ruleset-bypasses-for-repository-migrations)."}