Retirement of Global Personal Access Tokens in Azure DevOps
Dec 12, 2025Angel Wong
Summary
Announces the retirement of Global Personal Access Tokens (PATs) in Azure DevOps Services, citing security risks associated with broad credential reach. Provides key dates for blocking new global PAT creation/regeneration (December 1, 2026) and full decommissioning of existing global PATs (December 1, 2026). Recommends transitioning to short-lived, Microsoft Entra-backed authentication as a secure alternative. Offers guidance on how to review existing global PATs and outlines recommended actions for users relying on them.
More from the Azure DevOps Service Connection with Microsoft Entra trail
- You can now use the Azure DevOps Service Connection instead of a PAT or Build Session token
- Retirement of Azure DevOps issuer in Workload identity federation service connections
- Optimizing Git policy management at scale
- Azure DevOps MCP Server April Update
- One-click security scanning and org-wide alert triage come to Advanced Security