How to Use Claude Code AI to Automate Azure DevOps Deployments Inside a Private VNet with Conditional Access and IKEv2 VPN

Why Locked-Down Azure Environments Now Need an AI Co-Pilot

Enterprises in the GCC, EU and UK are pushing more of their delivery pipeline behind private networks. Public IPs are being retired, Azure DevOps agents are moving off the Microsoft-hosted pool onto self-hosted VMs inside a Virtual Network, and human access is being wrapped in Entra ID Conditional Access on top of an IKEv2 IPsec dial-in VPN. That is the right destination for regulated workloads — but the day-to-day cost is real. Every change to a YAML pipeline, every Bicep or Terraform module, every Conditional Access exclusion, every VPN client profile now has to be authored, reviewed, tested and rolled out inside a network your engineers can only reach through the VPN itself. Ticket queues balloon. Small changes take days.

Claude Code — Anthropic's official coding CLI — changes the economics of that model. Running on an engineer's workstation (already inside the private VNet through the IKEv2 tunnel), Claude Code reads and edits the exact repositories that drive Azure DevOps, writes the pipeline changes as a pull request, explains the diff, and iterates against pipeline logs until the run is green. In this article we show, end-to-end, how to combine Claude Code with a fully private Azure DevOps setup, Entra ID Conditional Access and an IKEv2 dial-in VPN so engineers keep the productivity of an AI teammate while the network posture stays enterprise-grade.

The Target Architecture at a Glance

Before the automation, agree on the shape of the platform. A pattern we deploy repeatedly for financial-services and energy clients in the UAE looks like this:

Azure DevOps organisation in the customer's Entra ID tenant, with Microsoft-hosted agents disabled. All build and release work runs on self-hosted agents in an Azure VM Scale Set living in a dedicated subnet of the platform VNet.
Private endpoints for Azure Key Vault, Azure Container Registry, Storage, SQL and Azure OpenAI. No PaaS resource is reachable over the public internet — DNS is resolved through Azure Private DNS zones linked to the VNet.
Azure VPN Gateway (VpnGw2 or above) configured for Point-to-Site with the IKEv2 tunnel type and Entra ID authentication (or certificate + RADIUS where legacy clients require it).
Entra ID Conditional Access policies that require compliant device, phishing-resistant MFA and an approved sign-in location before a user can either open a VPN tunnel or reach the Azure DevOps portal.
A source-of-truth Git repository — hosted in Azure Repos — that holds the infrastructure code (Bicep/Terraform), the pipeline YAML, the Conditional Access policy definitions and the VPN client configuration. That repo is where Claude Code does its work.

Where Claude Code Fits in the Delivery Flow

Claude Code is not a chatbot that sits beside the browser. It is a terminal-based agent that opens files, runs commands, executes tests and commits changes on the engineer's behalf. In this architecture it plays four roles:

Pipeline author. Given a plain-English requirement ("add a canary stage that deploys to the UAT slot only if the DAST scan passes"), Claude Code edits the azure-pipelines.yml, adjusts the templates, and pushes a branch.
Infrastructure engineer. Given a change like "add a new private endpoint for a second Key Vault in the shared-services subnet", Claude Code rewrites the Bicep or Terraform, runs bicep build or terraform plan locally against the VPN-reachable backend, and shows the diff before committing.
Policy assistant. Conditional Access and Intune device compliance are managed as JSON exported from Microsoft Graph. Claude Code proposes safe edits, keeps a break-glass account excluded, and generates the Graph API commands to preview the change before applying it.
Incident co-worker. When a pipeline run fails, Claude Code reads the log through the Azure DevOps REST API, correlates it with the last commit, proposes a fix, opens a PR, and re-runs the pipeline.

Preparing the Private VNet for Self-Hosted Agents

The first pillar is a build environment that never leaves the private network. A minimal but production-ready layout uses three subnets: GatewaySubnet for the VPN Gateway, snet-agents for the Azure DevOps agent VM Scale Set, and snet-pe for the private endpoints. Add a Network Security Group on snet-agents that allows outbound HTTPS to dev.azure.com, *.dev.azure.com, *.vsblob.visualstudio.com and the Microsoft Container Registry, and denies everything else — service tags make this maintainable.

Self-hosted agents pull work from Azure DevOps over an outbound long-poll connection, so they never need an inbound public IP. Register the pool with a Personal Access Token minted from a dedicated service account that is itself governed by Conditional Access. From Claude Code, the entire scale set — image, extensions, cloud-init, autoscale rules — is expressed in Bicep and committed to the repo. A prompt as simple as "scaffold a VMSS-based self-hosted Azure Pipelines agent pool that pulls the agent binary at boot, tags itself with the pool name from parameters, and joins the platform-vnet snet-agents subnet" will produce a first draft the team can review, tighten and merge.

Private Endpoints, Private DNS and the Agent Image

An agent is only as private as the endpoints it talks to. For every PaaS resource the pipelines touch, deploy a private endpoint into snet-pe and link the corresponding Private DNS zone (privatelink.vaultcore.azure.net, privatelink.azurecr.io, privatelink.blob.core.windows.net, and so on) to the platform VNet. The agent VM must resolve these zones through Azure-provided DNS or a custom DNS forwarder inside the VNet — otherwise az keyvault secret show silently traverses the public endpoint and Conditional Access based on IP will misbehave.

Bake the agent image with a golden pipeline: Ubuntu 22.04 or Windows Server 2022, PowerShell 7, Azure CLI, Bicep, Terraform, Docker and the Claude Code CLI installed for the engineers who SSH in for troubleshooting. Managed Identity is preferable to a service principal secret for the agent's own Azure authentication — assign it a least-privilege role on the target subscriptions and let the pipelines federate through azureLoginServiceConnection using Workload Identity Federation.

Entra ID Conditional Access — The Human Gate

Automation without a human control plane is not compliant. Conditional Access is where you enforce who, from where and how strongly, can touch this environment. A baseline that pairs well with Claude Code and Azure DevOps looks like this:

Engineers-CA-01 — DevOps portal access: require Intune-compliant device, phishing-resistant MFA (FIDO2 or Windows Hello for Business), and a named-location match (the corporate perimeter plus the VPN pool). Applies to the "Azure DevOps" cloud app.
Engineers-CA-02 — VPN sign-in: require compliant device and MFA when the user targets the Azure VPN enterprise application (App ID 41b23e61-6c1e-4545-b367-cd054e0ed4b4). This is what makes the IKEv2 tunnel itself a Zero Trust checkpoint.
Engineers-CA-03 — Session controls: sign-in frequency of 4 hours and persistent-browser off for privileged users; token protection for Windows clients where supported.
Break-glass exclusion: two cloud-only accounts, secured with FIDO2 keys stored in a physical safe, excluded from every policy — audited daily by Sentinel.

Claude Code can maintain these policies as code. Export them once with Get-MgIdentityConditionalAccessPolicy, store the JSON in the repo, and instruct the CLI to make edits ("add the UAE South named location to Engineers-CA-01"). Because the Graph API supports a "what-if" endpoint, wire a pipeline stage that runs the what-if against a set of canonical users before merging.

Point-to-Site VPN with IKEv2 for End Users

End users — engineers, DBAs, business analysts working with the private data plane — reach the environment through Azure VPN Gateway configured for Point-to-Site with the IKEv2 tunnel type. Two authentication modes are supported: Entra ID (recommended) or certificate. For Entra ID, you register the "Azure VPN" enterprise application in the tenant, grant admin consent, and download the VPN client profile from the gateway. IKEv2 is a machine-level tunnel; the Windows and macOS Azure VPN Client establishes it, then satisfies Conditional Access using the engineer's Entra ID credentials.

Key design choices to lock in before rollout:

Address pool: allocate a dedicated CIDR (for example 172.20.0.0/16) that does not overlap with any spoke VNet. This pool becomes a named location in Entra ID for the Conditional Access policies above.
Tunnel type: IKEv2 only. Disable OpenVPN and SSTP if you do not need them; smaller attack surface, cleaner troubleshooting.
Split vs. force tunnel: for administrative use, prefer force tunnel to guarantee that all traffic — including internet browsing — traverses the VNet and the corporate egress firewall. For hybrid-work use cases where employees also use the machine personally, split tunnel with routes advertised only for the corporate CIDR is acceptable if internet DLP is delivered separately (e.g. Defender for Cloud Apps or a SASE vendor).
Certificate hygiene: if you use certificate authentication, issue short-lived (30–90 day) certificates from an internal PKI or Intune Certificate Connector, not a single root exported to every laptop.
Custom DNS: push the private DNS resolver's IPs so clients on the tunnel resolve privatelink.* internally.

The Azure VPN Client profile can be distributed by Intune as an XML VPN configuration, so end users never have to import a file manually. Claude Code can generate the Intune configuration profile JSON from a short prompt and file it as a pull request against the endpoint-management repo.

End-to-End Pipeline: From Prompt to Production

With the platform in place, the day-to-day flow looks like this. An engineer connects to the VPN, opens VS Code inside the tunnel, and launches Claude Code from the integrated terminal.

Prompt. "Add a new deploy stage for the payments API to the pre-production slot in UAE North. It should require manual approval, deploy the Bicep in iac/payments, run the smoke test in tests/smoke, and gate promotion to production on a passing OWASP ZAP scan."
Plan. Claude Code reads the existing azure-pipelines.yml, the Bicep tree, and the tests. It proposes the diff, calls out the environments and service connections it will use, and asks the engineer to confirm.
Edit. On approval, it edits the YAML, adds a new stage template, wires the approval gate through an Azure DevOps environment (created via the REST API on the fly), and commits to a feature branch.
Pull request. A PR is opened against main. Reviewers see a clean diff with an explanation. Branch policies enforce two approvers, a green build, and a passing IaC security scan (Checkov, KICS or Defender for DevOps).
Run. On merge, the self-hosted agent picks up the pipeline. The agent uses its Managed Identity — via Workload Identity Federation — to authenticate to Azure. No secrets are stored in the pipeline.
Self-healing. If the first run fails, Claude Code fetches the failed log through the DevOps REST API, correlates it with the diff it just proposed, and offers a fix. The engineer approves and re-runs.

Secret Management and Least Privilege

The whole design is undone by one hard-coded PAT. To keep the automation clean:

Store every credential in Azure Key Vault behind a private endpoint. Pipelines fetch secrets through the Key Vault task using the agent's Managed Identity.
Use Workload Identity Federation for Azure Resource Manager service connections. This replaces long-lived client secrets with short-lived OIDC tokens.
Grant the agent's Managed Identity only the roles it needs on the target subscription — Contributor is almost never the right answer. Split by ring: read-only in production, contributor in non-production.
Prevent Claude Code from writing secrets to the repo by adding a pre-commit hook that runs gitleaks — Claude Code respects and reacts to hook failures.
Audit every use of the break-glass VPN accounts and the break-glass Entra ID accounts to a Sentinel workspace, with an alert rule firing on the first sign-in.

Observability, Audit and Change Traceability

Regulators — from the UAE's TDRA and CBUAE to European supervisors under DORA — want a straight line from "change requested" to "change deployed". The combination of Azure DevOps, Entra ID Conditional Access and Claude Code makes this easier than a traditional workflow, because every step already produces structured evidence.

Every pipeline run has an immutable log in Azure DevOps and can be shipped to a Log Analytics workspace using the built-in audit stream.
Every Conditional Access decision is logged in the Entra ID Sign-in logs. Combine with the Azure VPN Client telemetry and you can prove, for any tunnel, that MFA and device compliance were satisfied at the moment of connection.
Every Claude Code session on an engineer workstation can be captured by turning on the CLI's transcript export and shipping the JSON to a central store — useful for post-incident review and for training junior engineers.
Every commit is signed and every merge is protected by branch policies. The reviewer names are attached to the change record. Auditors love this.

Rollout Checklist for the First 30 Days

Stand up the platform VNet, VPN Gateway (IKEv2), and Private DNS zones.
Deploy the self-hosted agent VMSS from Bicep; register with Azure DevOps.
Move at least one non-production pipeline off the Microsoft-hosted pool and confirm a green run end-to-end through private endpoints.
Author the Conditional Access baseline (portal + VPN + session controls) with break-glass exclusions and enable in report-only mode for a week.
Distribute the Azure VPN Client profile to a pilot group via Intune. Validate MFA, DNS resolution and force-tunnel behaviour.
Onboard the engineering team to Claude Code on VPN-connected workstations. Establish repo conventions and pre-commit hooks.
Turn Conditional Access to "on", monitor Sign-in logs for a week, then start migrating production pipelines to the private pool.
Wire audit exports from Azure DevOps, Entra ID and the VPN Gateway into Log Analytics and Sentinel. Build a change-traceability workbook.

Common Pitfalls We See in the Field

DNS falls back to public endpoints. Missing Private DNS zone links quietly send traffic over the internet and break Conditional Access based on IP. Always test with Resolve-DnsName privatelink.vaultcore.azure.net on the agent.
Conditional Access excludes the wrong app. The "Windows Azure Service Management API" and "Microsoft Azure Management" cloud apps must be included, or engineers bypass MFA when using az login.
VPN Gateway SKU too small. Basic SKU does not support IKEv2 or Entra ID authentication. Start at VpnGw2AZ for zone redundancy.
Agent scale set behind a UDR without egress. If you force-tunnel agent traffic through an on-prem firewall, remember to whitelist dev.azure.com and its dependencies, or the agent goes offline in minutes.
Claude Code without repo guardrails. Configure the CLI's allow/deny list so it never runs destructive commands unattended in production paths. Pair with branch protection and mandatory reviewers.

How Aydahwa Enterprise Delivers This

Aydahwa Enterprise's engineering team builds this pattern for banks, energy operators and government-adjacent enterprises across the GCC, the EU and the UK. A typical engagement covers landing-zone design and Bicep authoring, Azure DevOps migration from Microsoft-hosted to self-hosted private agents, Conditional Access policy design with break-glass hardening, Azure VPN Gateway rollout with IKEv2 and Entra ID authentication, and enablement of the engineering team on Claude Code so the productivity gain sticks after handover. We combine that delivery work with our cybersecurity and cloud services practices so the same team is accountable for the pipeline, the network and the security posture.

If you are early in the journey, start with our free cybersecurity self-assessment and the cybersecurity readiness checklist — both take under 15 minutes and produce a prioritised list of gaps to close before you connect the first VPN client. When you are ready to design the platform, contact our team for a scoping call.

Closing Thought

The tension between "AI everywhere" and "network everywhere-private" is not real. Claude Code runs on the engineer's laptop, inside the same IKEv2 tunnel that already carries their sanctioned traffic, editing repositories that already live behind Conditional Access. Nothing about the AI teammate weakens the perimeter — and, done well, the automation actually raises the security floor because policy, infrastructure and pipelines all move to code, review and audit. That is the outcome regulators want and engineers finally enjoy.