devtunnel CLI: Missing read:org scope in GitHub OAuth flow prevents Organization access control

[fernandrone]

Description

Hey, not sure if I'm doing something wrong, but it seems that the devtunnel CLI fails to request the read:org scope during the GitHub login handshake. As the CLI apparently receives a token without this scope, it cannot verify organization membership, making it impossible to use the --org flag even when the Dev Tunnels GitHub App is correctly installed in the organization.

Steps to Reproduce

• Install the Dev Tunnels GitHub App in that organization as per the official documentation (I can verify that the GitHub App is installed):

• Run devtunnel user login -g in the terminal
• Note: the "Organization access" section is missing, preventing the user from "Granting" access to the org.

• Verify that it's installed in my GitHub user
• Attempt to host a tunnel with org access:

$ devtunnel host -p 8080 --org <org-name>.
Error: Tunnel service error: Request not permitted. GitHub token is missing required scope: read:org.

Expected Behavior

The GitHub token should have the read:org scope. Presumably I suppose the CLI should request the read:org scope by default during user login -g.

Environment

$ devtunnel --version
Tunnel CLI version: 1.0.1516+7e996fe917

Tunnel service URI        : https://global.rel.tunnels.api.visualstudio.com/
Tunnel service version    : 1.0.1632.58633 (e50901f950; 2026-03-02 17:39:11Z)
Tunnel service cluster    : brs

OS: macOS 15.7.2

[will-reynolds]

Thank you for posting about this issue. Have you managed to find the root cause or a workaround for it?

[fernandrone]

Thank you for posting about this issue. Have you managed to find the root cause or a workaround for it?

Not yet. If my understanding is correct the cause is that it seems that the CLI should request the read:org scope but doesn't. However the CLI code is not open-source so I can't be sure.

I've tried a lot of different things but didn't find any great workarounds. For a local proof-of-concept I ended up with a system where I run devtunnel in --anonymous but behind it have a middleware where I run my own github authx to validate connections come from my org... But I don't think it's a very good workaround for any number of reasons.

[plequere-ms]

Hi @fernandrone, let's try to clarify your scenario and repro steps, as this should work and we are unable to repro the issue on our end.

• Your first screenshot suggests that the app does have the appropriate permissions ("Read access to all members.") You should have been prompted for permission while installing the app.
• The CLI does request read:org scope. However, the error that you're seeing ("Error: Tunnel service error: Request not permitted. GitHub token is missing required scope: read:org.") is potentially misleading - looking at the source code, we return this error if we hit almost any HTTP 403 error from GitHub (except errors with the X-GitHub-SSO header.) This might be because of an expired token, account restrictions, or even potentially rate limiting. The error might be red herring, and we might need to look into another root cause.
• devtunnel host -p 8080 --org <org-name> is not a valid command. The --org flag is used with commands like devtunnels access create and devtunnels access add.