New Overlapping Secrets on Azure DevOps OAuth
Mar 26, 2025Angel Wong

Summary
Introduces 'overlapping secrets' for Azure DevOps OAuth apps, allowing a new secret to be generated while the old one remains valid. This facilitates programmatic secret rotation, reduces application downtime during transitions, and enables a shortened default secret lifespan of 60 days. The feature is accessible via the ADO OAuth app pages and the Rotate Registration Secret APIs, requiring the 'vso.tokens' scope.
More from the Azure DevOps OAuth App Secret Rotation trail
- Azure DevOps OAuth Client Secrets Now Shown Only Once
- Real-Time Security with Continuous Access Evaluation (CAE) comes to Azure DevOps
- Removing Azure Resource Manager reliance on Azure DevOps sign-ins
- Spring Cleaning: A CTA for Azure DevOps OAuth Apps with expired or long-living secrets
- Regenerating secrets for Azure DevOps OAuth applications