Authentication Token Security and Usage

2 posts · Aug 2016 – Aug 2025

What this trail covers

Azure DevOps Services and Server now support SHA-2 class key exchange algorithms (diffie-hellman-group-exchange-sha256) for SSH connections, addressing compatibility issues with newer OpenSSH clients that default to disabling SHA-1. This change was rolled out to Azure DevOps Services on March 6, 2020, and is being brought to Azure DevOps Server 2019 via an April 2020 patch, with Azure DevOps Server 2018 to follow. Additionally, Alternate Credentials authentication is being deprecated due to security concerns. This post announces the mandatory requirement of Server Name Indication (SNI) for all incoming HTTPS connections to Azure DevOps Services starting April 23rd, 2025, impacting older clients and software that do not support SNI.

All Microsoft trails

Aug 2025Real-Time Security with Continuous Access Evaluation (CAE) comes to Azure DevOpsIntroduced Continuous Access Evaluation (CAE) support for Azure DevOps, enabling near real-time enforcement of Microsoft Entra Conditional Access policies. This feature allows for rapid revocation of access upon critical events such as user deletion, password changes, or MFA enablement. The post details VPN considerations and their impact on IP address observation, providing troubleshooting guidance for administrators. For developers, it outlines the need to handle CAE rejections by implementing claims challenge extraction and token re-acquisition in client libraries, with specific mention of .NET client library requirements and upcoming support for Python and Go.
Apr 2025Important Update: Server Name Indication (SNI) Now Mandatory for Azure DevOps ServicesThis post announces the mandatory requirement of Server Name Indication (SNI) for all incoming HTTPS connections to Azure DevOps Services starting April 23rd, 2025. It explains that SNI is an extension to the TLS protocol that allows clients to specify the hostname they are connecting to. While most modern clients support SNI, older software, outdated networking libraries, or misconfigured systems may be impacted. The post provides specific error messages that may indicate SNI issues and offers detailed instructions for testing SNI compatibility on Windows and Linux, including how to modify the hosts file for software-level testing.
Feb 2025Full web support for conditional access policies across Azure DevOps and partner web propertiesThis post announces the full web support for conditional access policies across Azure DevOps and partner web properties by updating the web authentication stack to utilize Microsoft Entra tokens for web sessions. This replaces previous cookies with Entra tokens, enabling hourly evaluation of identity compliance with Entra policies, including support for device compliance policies. Non-interactive flows using personal access tokens will continue to support only IP-fencing policies.
Apr 2024End of Support for Microsoft products reliant on older Azure DevOps and Visual Studio authenticationThis post announces the end of support for older authentication methods used by out-of-support Visual Studio and Microsoft products with Azure DevOps. It lists specific older versions of Visual Studio, Dynamics AX, and Team Foundation Server that will no longer be guaranteed support. The change is driven by the need to move towards more secure and actively supported authentication mechanisms, allowing teams to focus on new security features. Customers are recommended to migrate to newer versions by December 31, 2024, with full functionality reliant on older authentication methods ceasing by March 2025.
Sep 2023New Azure DevOps scopes now available for Microsoft Identity OAuth delegated flow appsIntroduced new, granular scopes for delegated OAuth apps on the Microsoft Identity platform, aligning them with existing Azure DevOps OAuth scopes. This allows app developers to request specific permissions rather than the broad `user_impersonation` scope, enhancing security by reducing the attack surface of leaked access tokens. These new scopes are available for delegated flows only and do not apply to app-only flows. Existing apps using `user_impersonation` are advised to down-scope their permissions by consulting API Reference pages for required scopes.
Advertisement
May 2021IPv6 fencing Conditional Access Policies now supportedThis post extends Conditional Access Policy (CAP) support in Azure DevOps to include IPv6 fencing policies, in addition to existing IPv4 support. Previously, inbound IPv6 traffic was allowed without restriction. Now, IPv6 addresses will be subject to the same IP fencing policies defined in Azure AD, enhancing security by restricting access based on IP address ranges for both web and alternate authentication flows (PATs and SSH keys). Organizations need to ensure their CAP configurations include desired IPv6 ranges to grant access.
Nov 2019Azure DevOps will no longer support Alternate Credentials authenticationThis post announces the deprecation of Alternate Credentials authentication in Azure DevOps due to security risks (never expiring, cannot be scoped). Support will end on March 2, 2020. It provides guidance on checking for Alternate Credentials usage and recommends migrating to Personal Access Tokens (PATs) for Git usage, SSH keys for Linux, or OAuth for programmatic token refresh. It also details the deprecation timeline and contact information for questions.
Aug 2016Upcoming Changes to How You Log into Visual Studio Team ServicesThis post announces upcoming changes to Visual Studio Team Services (VSTS) login processes, aligning them with Azure Active Directory (AAD) and Office 365 (O365) login flows. The new login screens will simplify the process by first asking for the username, then the password, and will handle scenarios where a single email address maps to both a Microsoft Account (MSA) and a Work or School Account (WSA). It also provides guidance on how to sign out completely and troubleshoot common login errors.