TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Personal Access Token (PAT) Creation Restriction Policy

25 posts · Nov 2015 – Apr 2026

What this trail covers

Azure DevOps continues to enhance its security posture by deprecating global Personal Access Tokens (PATs). This evolution moves away from broad-scoped credentials towards organizational-level policies and short-lived, Microsoft Entra–backed authentication. The goal is to reduce the concentrated security risk associated with global PATs, offering improved token governance, stronger identity controls, and a reduced risk of credential exposure. The deprecation includes blocking the creation and re-issuance of global PATs, with a preview of a new policy to restrict PAT creation at the organization level, allowing administrators to control who can create or regenerate PATs. Exceptions can be managed via an allowlist for specific Microsoft Entra users or groups, and a sub-policy supports limiting token creation to packaging scopes only.

All Microsoft trails
  1. Optimizing Git policy management at scaleIntroduced a `refName=~all` parameter to the `GET /_apis/git/policy/configurations` REST API endpoint. This allows for efficient retrieval of all branch policies affecting any branch in a repository, as well as push policies affecting the entire repository, including inherited policies. This change significantly reduces server-side CPU consumption (by 2x) and execution time (by 10-15x) for enterprise policy management services that previously had to perform client-side filtering of all policies within a project.
  2. Retirement of Global Personal Access Tokens in Azure DevOpsThis post announces the retirement of the Global Personal Access Token (PAT) type in Azure DevOps Services, with a planned decommissioning date of December 1, 2026. Creation and regeneration of global PATs will be blocked starting December 1, 2026. The post provides instructions for users to review their existing global PATs and recommends transitioning to short-lived, Microsoft Entra–backed authentication or splitting authentication across individual organizations. This change is driven by security learnings and Microsoft's broader security strategy to mitigate concentrated security risks.
  3. Restricting PAT Creation in Azure DevOps Is Now in PreviewIntroduces a public preview of the 'Restrict personal access token creation policy' for Azure DevOps organizations. This policy allows Project Collection Administrators (PCAs) to control who can create or regenerate PATs. For new organizations, the policy is enabled by default (though this requirement was relaxed for public preview). Existing PATs continue to function until expiration. Global PATs require users to be on an allowlist. The policy can be enabled via Organization settings -> Policies. Exceptions can be managed by adding Microsoft Entra users or groups to an allowlist. A sub-policy allows creation of PATs with packaging scope only for users not on the allowlist.
  4. Reducing personal access token (PAT) usage across Azure DevOpsThis post announces the deprecation of the 'Generate Git Credentials' button in Azure Repos and Wiki, which previously generated 7-day PATs for Git clones. This button will be deactivated and eventually removed. The post encourages the use of Microsoft Entra tokens for Git operations, providing links to documentation on ad-hoc Entra token generation and updating Git Credential Manager. It also reiterates best practices for PAT creation and usage, such as setting short durations, minimal scopes, and revoking when no longer needed. Furthermore, it announces an upcoming organizational policy to disable PAT creation except for an authorized list of users.
  5. End of SSH-RSA support for Azure ReposAnnounces the deprecation and phased removal of SSH-RSA as a supported encryption method for SSH connections to Azure Repos. Details the four phases of deprecation for Azure DevOps Service (opt-in, throttling, brownout, removal) and provides guidance for Azure DevOps Server users to migrate to RSA-SHA2-256 or RSA-SHA2-512 keys. Includes steps for generating new keys, adding them to the SSH agent, configuring local SSH clients, and uploading public keys to Azure DevOps.
  7. Final notice of alternate credentials deprecationThis post announces the deprecation of alternate credentials authentication for Azure DevOps, with all usage being discontinued in January 2024. It directs affected users to explore alternative authentication methods, specifically recommending Personal Access Tokens (PATs) or managed identity and service principal support for application authentication.
  8. Setting up AAD Policies in Azure DevOpsThis post details the application of Azure Active Directory (AAD) policies within Azure DevOps. It explains how to assign the 'Azure DevOps Administrator' role in AAD to a custodian user, enabling them to configure organization-wide policies. These policies include 'Restrict Org Creation', 'Restrict Global PAT Creation', 'Restrict Full-Scoped PAT Creation', and 'Enforce Maximum PAT Lifespan'. The post provides screenshots illustrating the role assignment process and the available policy settings for both normal users and administrators within Azure DevOps.
  9. All Azure DevOps REST APIs now support PAT scopesThis post announces that all Azure DevOps REST APIs now support granular Personal Access Token (PAT) scopes. Previously, some APIs lacked scope association, leading to the use of full-scoped PATs which pose a significant security risk. The update allows customers to migrate to PATs with specific scopes required by each API, reducing the attack surface if a PAT is leaked. It also enables more customers to restrict the creation of full-scoped PATs via a control plane policy.
  10. Publishing extensions to Marketplace issue resolvedResolved an issue where publishing extensions to the Visual Studio Marketplace required global PATs, even when an administrator had restricted their creation. The extension publishing process has been redesigned to accept any PAT with a Marketplace "Publish" scope, allowing for seamless extension publishing regardless of global PAT restrictions.
  11. May patches for Azure DevOps Server and Team Foundation ServerThis patch introduces a fix for Azure DevOps Server and Team Foundation Server that revokes all personal access tokens after a user's Active Directory account is disabled. It also provides specific patch installation instructions and verification methods for Azure DevOps Server 2019.0.1, TFS 2018 Update 3.2, TFS 2017 Update 3.1, and TFS 2015 Update 4.2.
  12. Known issue with publishing extensions: “Your ability to create global personal access tokens (PATs) is restricted by your organization.”This post details a known issue where the 'Restrict creation of global PATs' policy in Azure DevOps prevents users from publishing extensions to the Visual Studio Marketplace via the CLI. It explains the symptom, cause, and provides workarounds: adding user accounts to an allowlist for the policy or disabling the policy altogether. It clarifies that a PAT is only needed for CLI publishing, not for the web portal.
  13. Azure DevOps Response to GitKraken SSH BugThis post details the revocation of insecure SSH keys generated by affected versions of GitKraken, impacting a small set of users. The revocation was performed on 10/11/2021, and affected individuals will be directly notified. Users are advised to remove and re-add their SSH public keys as a security precaution, even if not directly impacted.
  14. New policies to restrict personal access token scope and lifespanIntroduced new policies for Azure DevOps administrators to restrict Personal Access Token (PAT) creation. These policies allow administrators to: 1. Restrict the creation of global PATs (tokens valid across all accessible Azure DevOps organizations). 2. Restrict the creation of full-scoped PATs. 3. Define a maximum lifespan for newly created PATs. These policies apply to new PATs created for Azure DevOps organizations linked to an Azure AD tenant. Allowlists can be configured for users and groups who are exempt from policy management but cannot configure policies. Existing PATs are unaffected but must be updated to comply before renewal.
  15. Personal Access Token Lifecycle APIs in general availabilityAnnounces the general availability of the Personal Access Token (PAT) Lifecycle Management APIs, providing a robust alternative to the UI for creating and managing PATs. These APIs enable automated pipelines for rotating soon-to-be-expired PAT tokens, reducing manual effort and strengthening security. The post directs users to public documentation for API authentication, reference, and a sample application, and includes an FAQ section.
  16. Mitigating leaked personal access tokens (PATs) found on GitHub public repositoriesThis post announces the initiation of scanning for Azure DevOps PATs in public GitHub repositories. When a leaked token is found, the owner receives an email notification, an audit log event is generated in Azure DevOps, and the token is automatically revoked. This is a proactive security measure to protect accounts and data from compromised credentials.
  17. Billing and Token Management events now available in AuditingAdded two new event types to Azure DevOps auditing logs: Billing setup and management events (including subscription changes, pipeline purchases, and max quantity changes for usage-based meters) and Personal Access Tokens (PATs) and SSH Keys management events (tracking creation, update, revocation, and removal).
  18. New Personal Access Token Lifecycle APIs in private previewIntroduced new APIs to manage the lifecycle of Personal Access Tokens (PATs) on Azure DevOps, enabling creation with desired scope and duration, renewal, and expiration. This unlocks automation for tasks like setting up build pipelines or interacting with work items, simplifying maintenance and rotation.
  19. Azure DevOps will no longer support Alternate Credentials authenticationThis post announces the deprecation of Alternate Credentials authentication in Azure DevOps due to security risks. It details the timeline for disabling this feature, starting March 2, 2020, and provides guidance for users to migrate to more secure authentication methods such as Personal Access Tokens (PATs) or SSH keys. It also explains how to check if Alternate Credentials are configured and what actions to take.
  20. Revoking potentially impacted tokens from ESLint vulnerabilityThis post details the revocation of access tokens due to a malicious ESLint NPM package incident. It specifically impacts users of VSTS Package Management and those using access tokens in configuration files for package feeds. The action involves invalidating access tokens and provides instructions for regenerating tokens for NPM, NuGet, Maven, and Gradle. It also mentions the revocation of globally scoped access tokens used for general automation and advises users to create new personal access tokens if their automation is failing. Instructions for creating a VSTS support case are also provided.
  21. Enabling administrators to revoke VSTS access tokensIntroduced new REST APIs for administrators to centrally revoke Personal Access Tokens (PAT) and JSON Web Tokens (JWT) created by users in their Visual Studio Team Services (VSTS) accounts. Provided a PowerShell script to automate calling these APIs by passing a list of user principal names (UPNs). Announced an automated revocation of potentially impacted tokens for affected customers on August 3, 2018, following email notification to VSTS account admins.
  22. Protecting our users from the ESLint NPM package breachThis post details the response to a security incident involving malicious code in two popular NPM packages (eslint-scope and eslint-config-eslint). It describes the revocation of access tokens for at-risk users and announces the upcoming deployment of new REST APIs that will allow administrators of Visual Studio Team Services accounts to centrally revoke Personal Access Tokens (PATs) and JSON Web Tokens (JWTs). It also directs users to documentation for regenerating revoked tokens and revoking their own PATs.
  23. Improved user settings in Visual Studio Team Services (VSTS)Introduces an updated user interface for VSTS user settings with improved navigation, support for continuous saving without exiting settings, and the ability to manage OAuth authorizations within user profiles. This centralizes OAuth management across VSTS accounts and streamlines the user settings experience.
  24. Improved alternate authentication experience for Visual Studio Team Services (VSTS)This post details planned improvements to the end-user experience for generating and managing Personal Access Tokens (PATs) in Visual Studio Team Services (VSTS). Key enhancements include a more understandable PAT creation experience with guided steps, user-selectable expiration dates (with administrative policy enforcement), and scopes grouped by area with inline help. The list view for PATs will be improved to show scopes, accounts, last used date, and IP address, with filtering capabilities. Users will receive email notifications for expiring PATs. Administrators will gain APIs to audit user actions (IP, authentication type) and apply their own business logic, and new policies to manage maximum PAT lifetimes, including the option for never-expiring PATs. Administrators will also be able to revoke PATs for compromised users directly from the users hub. The post also mentions updating SSH and Basic credential experiences to match the new UX styles.
  25. Using Open Source Components? Using TFS?Announces the availability of the WhiteSource Bolt extension for on-premises TFS, extending its functionality beyond VSTS. This allows for automated security checks of open-source components and licenses within TFS release pipelines, including vulnerability identification and links to fixes.
  26. Streamlined User ManagementIntroduces a preview of a new account-level user hub experience in Visual Studio Team Services (VSTS). This feature simplifies user management by allowing administrators to invite users with proper extensions, access levels, and group memberships in a single step. It also provides a re-designed Users page with an 'Extensions' column for at-a-glance understanding of user access, and a detailed view for individual users to manage their access level, extensions, and group memberships.
  27. Team Services Large Account User Management Roadmap (April 2017)Introduces bulk editing for users to manage access levels, extensions, and group memberships simultaneously. Adds Azure Active Directory (AAD) group support for assigning access levels and extensions, automating resource assignment for new users based on AAD group memberships. Outlines future work on licensing-only/security-only administrators, guest invitations, and project/team-level user management.
  28. Git Credential Manager for Mac and LinuxIntroduced the Git Credential Manager (GCM) for Mac and Linux, an open-source tool that acts as a Git credential helper. It simplifies authentication to remote Git repositories, especially those hosted in Visual Studio Team Services (VSTS), by supporting multi-factor authentication. GCM uses OAuth 2.0 to obtain an access token, which is then used to create a VSTS Personal Access Token (PAT) with the `vso.code_write` scope. This PAT is stored locally and used for subsequent repository accesses, eliminating repetitive sign-ins. The post also mentions the existing GCM for Windows and provides links to documentation and source code.