Tasks for the operator

Operator Step 1. Sign in to ADO as the service account

On your dedicated Mac (ideally a Mac that is separate from the one you use daily), open a browser and navigate to dev.azure.com/your-org.

Sign in to ADO using the service account credentials (CXOsignal-alerts@yourcompany.com) that your IT admin sent you. Once signed in, switch to the dedicated CXOrelay Operations project (the one your IT admin created in Admin Task 2 and granted the service account Project Admin on in Admin Task 3).

If you don't see the project, or you get a "you don't have access" error, ask your IT admin to confirm Admin Tasks 1, 2, and 3 are all complete.

Operator Step 2. Create the CXOrelay dashboard

CXOrelay needs an ADO dashboard where it will sit. Recommendation: create a brand-new dashboard called CXOrelay — one dedicated dashboard that holds nothing but the relay widget.

1. In the project's left sidebar, click Overview → Dashboards.
2. Click the + New dashboard button at the top.
3. Give it a name: CXOrelay works. Click Create.
4. You'll land on an empty dashboard. Leave this tab open.

Operator Step 3. Add the CXOrelay widget

1. On your new CXOrelay dashboard, click Add a widget. The dashboard goes into edit mode and a "Widgets" panel slides in from the right.
2. In the search box at the top of the Widgets panel, type cxo relay.
3. The CXOrelay widget shows up. Drag it onto the dashboard.

4. Click the gear icon to open the configuration dialog. On the General tab:

   • Set the Width to 7 and Height to 6 at the top. (CXOrelay needs room — smaller sizes will crop the panel.)
   • Fill in Widget title. Since you might be running CXOrelay on multiple machines, we recommend a naming convention like [MachineName].CXO-relay. This name shows up in the widget header and in the "other CXOrelay instances" panels on other machines running CXOrelay.
   • Leave the other fields (stale threshold, offline threshold, max log entries) at their defaults.
5. Click Save to commit the widget. Click Done Editing to exit edit mode.

Operator Step 4. Configure CXOrelay with the Client ID + Tenant ID, then sign in

This is where you need the two UUIDs your IT admin sent you.

1. Click anywhere in the CXOrelay widget and then the … (three-dot menu) in the top-right corner. Choose Configure.
2. The configuration dialog opens. Click the Sign in to Microsoft tab at the top.

3. Paste both UUIDs from your IT admin:

   • Entra Application (client) ID: paste the Application (client) ID UUID.
   • Microsoft tenant ID: paste the Directory (tenant) ID UUID. Required because the Entra app is single-tenant. Without it, sign-in fails with AADSTS50194.

   Leave Daily email cap at its default of 100 to start. This means the relay won't send more than 100 notification emails per day across all your signals.

4. After pasting both UUIDs, the Sign in button becomes active. Click it.
5. A Microsoft account-picker popup opens. Choose the service account — CXOsignal-alerts@yourcompany.com. If you don't see it in the list, click Use another account and sign in with the service account credentials. Picking the wrong account here is the single most common setup mistake. Microsoft may have cached other accounts — be careful.
6. After picking the account, Microsoft may ask you to consent to two permissions: Send mail as you (Microsoft Graph Mail.Send) and Access Azure DevOps services as the signed-in user (ADO user_impersonation). Click Accept. (If your IT admin granted tenant-wide admin consent in Admin Task 4.5, you won't see this prompt.)
7. When the popup closes, the config dialog's status line under the Sign-in button should now show ✓ Signed in as CXOsignal-alerts@yourcompany.com.
8. Close the configuration panel. Continue to Verifying the setup worked to confirm everything's running.