TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

NTLM Removal in Git (libcurl) for Azure DevOps Server

9 posts · Nov 2015 – Jul 2026

What this trail covers

This thread tracks the evolution of Git authentication methods for Azure DevOps Server, focusing on the deprecation of NTLM and the transition to more secure alternatives like Kerberos and SSH. It addresses the impact of libcurl removing NTLM support and provides guidance for customers to validate their current authentication mechanisms and plan for the transition to avoid service disruption.

All Microsoft trails
  1. Upcoming Change: NTLM Removal in Git (libcurl) – Impact to Azure DevOps Server CustomersThis post announces the upcoming removal of NTLM support from libcurl in September 2026, which will break Git operations over HTTPS against Azure DevOps Server for customers relying on NTLM authentication. It details how to identify NTLM usage through warnings, klist, and HTTP traces, and strongly recommends transitioning to Kerberos authentication. It also advises against NTLM fallback and suggests SSH as an alternative for workgroup environments. The post emphasizes the need for end-to-end Kerberos configuration, including SPNs and IIS settings, and provides guidance on planning for the removal of NTLM fallback.
  2. End of Support for Microsoft products reliant on older Azure DevOps and Visual Studio authenticationAnnounces the end of support for older authentication methods used by out-of-support Visual Studio and Microsoft products with Azure DevOps. Lists specific impacted products and their end-of-support dates. Recommends migration to newer versions by December 31, 2024, due to security concerns and resource allocation for maintaining outdated authentication paradigms. Mentions that functionality reliant on older Azure DevOps authentication may not be supported by March 2025.
  3. End of SSH-RSA support for Azure ReposAnnounces the deprecation and phased removal of SSH-RSA support for SSH connections to Azure Repos. Details the technical rationale (weak encryption), provides a four-phase rollout plan for Azure DevOps Service with specific timelines and error messages, and outlines the impact and migration steps for Azure DevOps Server users. Introduces RSA-SHA2-256 and RSA-SHA2-512 as secure alternatives and provides instructions for generating and configuring new keys.
  4. August patches for Azure DevOps ServerThis post details the August patches for Azure DevOps Server across multiple versions (2022.0.1, 2020.1.2, 2020.0.2, 2019.1.2, 2019.0.1). Key technical updates include the resolution of CVE-2023-36869 (Azure DevOps Server Spoofing Vulnerability) in all patched versions. For Azure DevOps Server 2020.1.2 and 2019.1.2, the SSH service has been updated to support SHA2-256 and SHA2-512, which is a continuation of the effort to remove weaker encryption methods like RSA. Other fixes include addressing issues with relative links in markdown files, comment navigation on commit pages, performance issues with application tier startup due to a large number of tags, and bugs related to Analysis Owner identity display and CronScheduleJobExtension.
  5. Reconfigure Azure DevOps Server to use Kerberos instead of NTLMThis post addresses the issue of Git LFS v3.0+ dropping NTLM support, impacting Azure DevOps Server on-premises. It recommends reconfiguring Azure DevOps Server to use Kerberos authentication instead of NTLM, providing guidance on IIS configuration and noting that Kerberos is not supported in Workgroup environments. It also mentions that the hosted Azure DevOps service is not impacted.
  7. Deprecating weak cryptographic standards (TLS 1.0 and 1.1) in Azure DevOps ServicesThis post announces the completion of the deprecation of TLS 1.0 and 1.1 for Azure DevOps Services (dev.azure.com and *.visualstudio.com domains), enforcing TLS 1.2 for all HTTPS connections. It details a partial rollback due to unexpected issues on January 31st, 2022, and outlines the final rollout starting March 31, 2022. Temporary 12-hour downtimes were scheduled for March 22nd and 24th, 2022, to help customers identify incompatible software. Guidance is provided on enabling TLS 1.2 for self-hosted agents and API calls, including checks for Windows Server versions, .NET Framework installations, and required cipher suites. Manual PowerShell checks, YAML pipeline steps, and a dedicated pipeline task are offered for compatibility testing. A troubleshooting script for common misconfigurations is also shared on GitHub.
  8. Deprecating weak cryptographic standards (TLS 1.0 and TLS 1.1) in Azure DevOpsThis post announces the deprecation of TLS 1.0 and TLS 1.1 in Azure DevOps Services, mandating TLS 1.2 for all HTTPS connections by January 31, 2022. It details the security rationale, phased rollout plan with temporary disablements, and provides comprehensive instructions for enabling TLS 1.2 across various client environments, including .NET Framework, Visual Studio, and older operating systems. It also highlights potential error messages and registry configurations for troubleshooting.
  9. October patch for Team Foundation ServerThis patch for Team Foundation Server 2018 Update 3.2 adds the ability to select the set of SSH key exchange algorithms, allowing for the disabling of SHA1 in favor of SHA2. It provides instructions for verifying the installation of Patch 13.
  10. Azure DevOps Services to require TLS 1.2 (Updated)This post announces the deprecation of TLS 1.0 and TLS 1.1 in Azure DevOps Services, requiring TLS 1.2 for all HTTPS connections. It details the security rationale, phased rollout plan with temporary disablements and a grace period, and provides specific PowerShell scripts and .NET Framework recommendations for enabling TLS 1.2 on client systems. It also directs users to a developer community item for reporting issues and provides contact information for further questions. An update later postponed this change indefinitely.
  11. Remediating the October 2018 Git Security VulnerabilityThis post addresses a security vulnerability in Git's recursive submodule cloning that could lead to arbitrary code execution. It clarifies that Git for Windows is not vulnerable due to filesystem restrictions. Visual Studio and Visual Studio Code are also not directly impacted, but users are encouraged to upgrade their system's Git client. Azure Repos will prevent the push of malicious Git repositories as a mitigation.
  12. Announcing the Git Credential Manager for Windows 1.0This post announces version 1.0 of the Git Credential Manager for Windows (GCM), a replacement for the unmaintained WinStore credential manager. It highlights key features including secure password storage, MFA/2FA support for VSTS and GitHub, PAT generation/usage, non-interactive mode for VSTS with Azure AD, and build agent optimization. The post explains the seamless setup and usage flow, including how GCM handles authentication for VSTS and automatically reuses credentials.
  13. Git Credential Manager for Mac and LinuxAnnounces the open-source release of Git Credential Manager (GCM) for Mac and Linux, a Git credential helper that supports multi-factor authentication for remote Git repositories, specifically Visual Studio Team Services (VSTS). It details the authentication flow using OAuth 2.0 to obtain an access token, which is then used to create a VSTS Personal Access Token (PAT) for Git read/write operations. The PAT is stored locally and used for subsequent accesses, with the ability for users to revoke it. This follows the release of GCM for Windows.