Azure DevOps OAuth App Secret Rotation

4 posts · Oct 2015 – Aug 2025

What this trail covers

Azure DevOps OAuth apps are being deprecated in 2026, encouraging migration to Microsoft Identity platform. Regular removal of apps with expired secrets (over 180 days) will occur. New overlapping secrets feature allows downtime-free secret rotation for apps with long-lasting secrets. New Azure DevOps OAuth app secrets will default to a 60-day lifespan.

All Microsoft trails

Aug 2025Azure DevOps OAuth Client Secrets Now Shown Only OnceThis post announces a change in how Azure DevOps displays OAuth client secrets, moving to a 'show only once' model for newly generated secrets. It also details the deprecation of the Get Registration Secret API and directs users to use new secret rotation APIs that support overlapping secrets to avoid downtime. This aligns with the 'Secure First Initiative'.
Aug 2025Real-Time Security with Continuous Access Evaluation (CAE) comes to Azure DevOpsIntroduces Continuous Access Evaluation (CAE) support in Azure DevOps, enabling near real-time enforcement of Microsoft Entra ID Conditional Access policies. This revokes access quickly after critical events like user deletion, password changes, or MFA enablement by establishing a two-way conversation between Entra ID and Azure DevOps for access-time policy enforcement. Discusses VPN considerations and potential IP address discrepancies affecting CAE. Requires developers using the .NET client library to handle CAE rejections by extracting claims challenges and retrying requests.
Jun 2025Removing Azure Resource Manager reliance on Azure DevOps sign-insAzure DevOps is removing its reliance on the Azure Resource Manager (ARM) audience for sign-in and token refresh flows. This change allows for more granular Conditional Access policies to be applied specifically to Azure DevOps, rather than relying on ARM-based policies. Administrators will need to create new Azure DevOps-exclusive Conditional Access policies to maintain access controls. Exceptions for billing administrators and service connection creators are noted.
Apr 2025Spring Cleaning: A CTA for Azure DevOps OAuth Apps with expired or long-living secretsThis post announces the official closure of new Azure DevOps OAuth app registrations and outlines the phased approach to deprecating existing OAuth apps by 2026. It details the regular removal of apps with expired secrets (over 180 days) and the introduction of the 'overlapping secrets' feature to facilitate downtime-free secret rotation for apps with long-lived secrets. New secrets will default to a 60-day lifespan.
Mar 2025New Overlapping Secrets on Azure DevOps OAuthIntroduces 'overlapping secrets' for Azure DevOps OAuth apps, allowing a new secret to be generated while the old one remains valid. This facilitates programmatic secret rotation, reduces application downtime during transitions, and enables a shortened default secret lifespan of 60 days. The feature is accessible via the ADO OAuth app pages and the Rotate Registration Secret APIs, requiring the 'vso.tokens' scope.
Advertisement
Feb 2024Regenerating secrets for Azure DevOps OAuth applicationsIntroduces the ability for Azure DevOps OAuth app owners to self-regenerate client secrets directly from their profile page, eliminating the need to contact customer support. This feature allows for proactive replacement of expiring secrets and immediate revocation of leaked secrets. The 'Regenerate Secret' button and expiration date are now visible on the app settings page. Regenerating a secret invalidates the previous secret and all associated access tokens.
Oct 2015Automating Azure Resource Group deployment using a Service Principal in Visual Studio Online: Build/Release ManagementThis post details how to connect Azure subscriptions to Visual Studio Team Services (VSTS) for deploying Azure Resource Manager resources. It outlines two methods: an automated approach using a PowerShell script to create a new Azure Service Principal, and a manual configuration process involving creating an Azure Active Directory application, generating a service principal password, and assigning roles via Azure PowerShell or the Azure portal. The post emphasizes the security implications of role assignments and provides links to relevant documentation.