Audit reporting workflow stuck at pending review state in Azure Boards

ALM Azure DevOps
, , , , , , , ,
1

Our compliance team is hitting a blocker with custom audit reporting workflows in Azure Boards. We built a process template with custom work item types for audit reports, but they’re consistently getting stuck at the ‘Pending Review’ state and won’t transition to ‘Approved’ even when all conditions are met.

The workflow has automation rules that should trigger when certain fields are populated, but we’re seeing query delays and the service account doesn’t seem to have the right permissions. We’ve configured webhooks to notify external systems, but those aren’t firing either.

Here’s the rule configuration we’re using:

{
  "trigger": "workItemUpdated",
  "conditions": ["System.State == 'Pending Review'"],
  "actions": ["transitionTo: Approved"]
}

Anyone dealt with automation rule conflicts or webhook configuration issues in audit workflows? This is blocking our entire compliance process.

2

For the webhook issue, verify your endpoint configuration in Project Settings > Service hooks. The webhook URL needs to be publicly accessible and respond within 15 seconds or Azure DevOps will mark it as failed. Also check if your firewall is blocking outbound requests from Azure DevOps IP ranges. Use the webhook test feature to see if you’re getting any error responses. Common issues include SSL certificate problems or authentication headers not being passed correctly.

3

Query delays are definitely a factor here. Azure Boards automation rules use work item queries under the hood, and if your query is complex or touches too many work items, it can timeout. The default query timeout is 30 seconds. Check your rule conditions - are you filtering on custom fields that aren’t indexed? Also, if multiple rules are checking the same work items simultaneously, you’ll get conflicts where one rule locks the item while another tries to update it. I’ve seen this cause the ‘stuck’ behavior you’re describing.

4

First thing to check is service account permissions. The account running your automation rules needs specific access rights in Azure DevOps. Go to Organization Settings > Users and verify your service account has at least ‘Basic’ access level, not ‘Stakeholder’. Also check Project Settings > Permissions and ensure it has ‘Edit work items in this node’ permission for the area path where your audit reports live.

5

Excellent troubleshooting thread. Let me provide a comprehensive solution that addresses all the issues mentioned.

1. Automation Rule Conflicts The core problem is rule execution order and overlapping conditions. In your process template, go to Organization Settings > Process > Rules and implement a sequential execution pattern:

  • Rule 1 (Priority 1): Field validation only - no state transition
  • Rule 2 (Priority 2): State transition after validation passes
  • Use ‘When a work item is created or modified’ trigger with specific field conditions

Avoid having multiple rules that modify System.State simultaneously. Use the ‘Disable rule’ option during testing to isolate conflicts.

2. Service Account Permissions Your service account needs these specific permissions:

  • Project-level: ‘Edit work items in this node’ + ‘Manage test plans’ + ‘Manage test suites’
  • Organization-level: ‘View instance-level information’
  • Area Path: Explicit ‘Allow’ for ‘Edit work items’ on the audit report area path

Create a custom security group specifically for automation accounts to manage these permissions centrally.

3. Webhook Configuration For reliable webhook delivery:

{
  "publisherId": "tfs",
  "eventType": "workitem.updated",
  "resourceVersion": "1.0",
  "consumerId": "webHooks",
  "consumerActionId": "httpRequest",
  "publisherInputs": {
    "workItemType": "Audit Report",
    "areaPath": "YourProject\\Compliance"
  }
}

Ensure your webhook endpoint returns HTTP 200 within 15 seconds and handles retry logic for transient failures. Azure DevOps will retry 3 times with exponential backoff.

4. Query Delays Optimize your automation rule queries:

  • Index custom fields used in rule conditions (Organization Settings > Process > Fields > Options > Indexed)
  • Limit rule scope to specific area paths rather than entire project
  • Use ‘Changed From/To’ conditions instead of ‘Contains’ for better performance
  • Monitor query execution in Analytics via OData: `https://analytics.dev.azure.com/{org}/_odata/v3.0-preview/WorkItemRevisions Implement these changes in order, testing after each step. The combination of proper rule sequencing, correct permissions, reliable webhooks, and optimized queries should resolve your stuck workflow issue completely.