feature(azure devops): support multiple organisations

Signed-off-by: Sander Aernouts <sander.aernouts@gmail.com>

docs/integrations/azure/locations.md

@@ -19,10 +19,10 @@ Using a service principal:
 integrations:
   azure:
     - host: dev.azure.com
-      credential:
-        clientId: ${CLIENT_ID}
-        clientSecret: ${CLIENT_SECRET}
-        tenantId: ${TENANT_ID}
+      credentials:
+        - clientId: ${AZURE_CLIENT_ID}
+          clientSecret: ${AZURE_CLIENT_SECRET}
+          tenantId: ${AZURE_TENANT_ID}
 ```
 
 Using a managed identity:
@@ -31,8 +31,8 @@ Using a managed identity:
 integrations:
   azure:
     - host: dev.azure.com
-      credential:
-        clientId: ${CLIENT_ID}
+      credentials:
+        - clientId: ${AZURE_CLIENT_ID}
 ```
 
 Using a personal access token (PAT):
@@ -41,24 +41,54 @@ Using a personal access token (PAT):
 integrations:
   azure:
     - host: dev.azure.com
-      token: ${AZURE_TOKEN}
+      credentials:
+        - personalAccessToken: ${PERSONAL_ACCESS_TOKEN}
 ```
 
+You can use specific credentials for different Azure DevOps organizations by specifying the `organizations` field on the credential:
+
+```yaml
+integrations:
+  azure:
+    - host: dev.azure.com
+      credentials:
+        - organizations:
+            - my-org
+            - my-other-org
+          clientId: ${AZURE_CLIENT_ID}
+          clientSecret: ${AZURE_CLIENT_SECRET}
+          tenantId: ${AZURE_TENANT_ID}
+        - organizations:
+            - another-org
+          clientId: ${AZURE_CLIENT_ID}
+        - organizations:
+            - yet-another-org
+          personalAccessToken: ${PERSONAL_ACCESS_TOKEN}
+```
+
+If you do not specify the `organizations` field the credential will be used for all organizations for which no other credential is configured.
+
 > Note: An Azure DevOps provider is added automatically at startup for
 > convenience, so you only need to list it if you want to supply a
-> [token](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate),
+> [personalAccessToken](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate),
 > a [service principal](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity),
 > or a [managed identity](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity)
 
 The configuration is a structure with these elements:
 
-- `host`: The DevOps host; only `dev.azure.com` is supported.
-- `token` (optional): A personal access token as expected by Azure DevOps.
-- `credential`: (optional): A service principal or managed identity
+- `credentials`: (optional): A service principal, managed identity, or personal access token
+
+The `credentials` element is a structure with these elements:
+
+- `organizations`: (optional): A list of organizations for which this credential should be used. If not specified the credential will be used for all organizations for which no other credential is configured.
+- `clientId`: The client ID of the service principal or managed identity (required for service principal and managed identities)
+- `clientSecret`: The client secret of the service principal (required for service principal)
+- `tenantId`: The tenant ID of the service principal (required for service principal)
+- `personalAccessToken`: The personal access token (required for personal access token)
 
 > Note:
 >
-> - `token` and `credential` are mutually exclusive.
 > - You cannot use a service principal or managed identity for Azure DevOps Server (on-premises) organizations
 > - You can only use a service principal or managed identity for Azure AD backed Azure DevOps organizations
-> - The token should just be provided as the raw token generated by Azure DevOps using the format `raw_token` with no base64 encoding. Formatting and base64'ing is handled by dependent libraries handling the Azure DevOps API
+> - You can only specify one credential per host without any organizations specified
+> - The personal access token should just be provided as the raw token generated by Azure DevOps using the format `raw_token` with no base64 encoding. Formatting and base64'ing is handled by dependent libraries handling the Azure DevOps API