Restricting PAT Creation in Azure DevOps Is Now in Preview

Introduces a public preview of the 'Restrict personal access token creation policy' for Azure DevOps organizations. This policy allows Project Collection Administrators (PCAs) to control who can create or regenerate PATs. For new organizations, the policy is enabled by default (though this requirement was relaxed for public preview). Existing PATs continue to function until expiration. Global PATs require users to be on an allowlist. The policy can be enabled via Organization settings -> Policies. Exceptions can be managed by adding Microsoft Entra users or groups to an allowlist. A sub-policy allows creation of PATs with packaging scope only for users not on the allowlist.