Azure DevOps Global Personal Access Token Retirement on December 1, 2026

Microsoft Azure DevOps authentication update

Global Personal Access Tokens (PATs) will retire on December 1, 2026. Customers using them with AutoRABIT should move to organization-scoped PATs before that date. No AutoRABIT upgrade is required for this migration.

Key message for customers

This is a Microsoft Azure DevOps platform change. Organization-scoped PATs continue to work with AutoRABIT today, so customers can complete the required migration without waiting for a product release.

Azure DevOps Global Personal Access Token Retirement

Action required before December 1, 2026

Microsoft is retiring Global Personal Access Tokens (PATs) in Azure DevOps Services. A Global PAT is a token whose access scope is set to All accessible organizations.

On December 1, 2026, existing Global PATs will stop working. Organization-scoped PATs are not affected and can continue to be used with AutoRABIT.

This change is part of Microsoft’s Azure DevOps authentication updates. No AutoRABIT product upgrade is required to move from a Global PAT to an organization-scoped PAT.

Who should review this?

Review your configuration if AutoRABIT connects to repositories in Azure DevOps Services using a Personal Access Token.

You are affected only if the PAT currently used is a Global PAT with the scope All accessible organizations.

How to check whether you use a Global PAT

1. Sign in to your Azure DevOps organization.
2. Open User settings and select Personal access tokens.
3. Filter Access scope to All accessible organizations and Status to Active.
4. Any active token shown in this view is a Global PAT and should be replaced before December 1, 2026.

If no active Global PATs are listed, no change is required for this Microsoft retirement.

What you need to do

1. Identify the Azure DevOps organizations used by your repositories

A Global PAT can be used across multiple Azure DevOps organizations. An organization-scoped PAT is limited to one organization. If your AutoRABIT repositories span multiple Azure DevOps organizations, create a separate organization-scoped PAT for each organization.

2. Create an organization-scoped PAT in Azure DevOps

Create a new PAT and select the specific Azure DevOps organization instead of All accessible organizations.

Recommended permissions:

• Code - Read, Write and Manage - Required for repository operations such as commits, merges, CI jobs, deployments, and pull requests.
• Member Entitlement Management - Read - Required only if you select reviewers when creating pull requests from AutoRABIT.

Set the token expiration according to your organization’s security policy and record the expiration date for future rotation.

3. Add the new credential in AutoRABIT

In AutoRABIT, go to Admin > Credentials and create a credential for the new organization-scoped PAT.

Credential type: Username With Password

Enter your Azure DevOps user name in the User Name field and the PAT in the Password field.

Tip: Include the Azure DevOps organization name in the credential name so it is easy to identify which credential belongs to each organization.

4. Update the places that use the credential

Review the following areas and replace the Global PAT credential with the correct organization-scoped credential where applicable:

• Admin > Repository Manager
• Admin > ALM Management
• Admin > User Management for any user-specific repository or ALM credentials
• Your own user profile if you have configured a personal repository credential

User-specific credentials are important to review because they can override the shared credential configured for a repository or ALM connection.

5. Validate the connection

After updating the credentials, validate your normal Azure DevOps workflows before December 1, 2026. We recommend testing at least one repository operation and one CI workflow for each Azure DevOps organization you use.

If you use pull requests from AutoRABIT, also create a test pull request and confirm that the reviewer list loads correctly.

What is not changing

• Organization-scoped PATs continue to be supported.
• Existing repositories do not need to be re-registered simply because Microsoft is retiring Global PATs.
• No AutoRABIT upgrade is required to replace a Global PAT with an organization-scoped PAT.
• Azure DevOps Server connections used for Azure Boards are not affected by Microsoft’s Azure DevOps Services Global PAT retirement.

Future authentication direction

AutoRABIT is also working toward Microsoft Entra ID-based authentication for Azure DevOps Services, aligned with Microsoft’s recommended direction for modern authentication. This capability will be communicated separately when available.

Customers should not wait for this future capability to address the December 1, 2026, Global PAT retirement. Moving to organization-scoped PATs is the supported action available today.

Need help?

If you need help identifying which AutoRABIT repositories use each Azure DevOps organization, or assistance updating credentials, contact AutoRABIT Support or your Customer Success Manager.

Reference

Microsoft announcement: Retirement of Global Personal Access Tokens in Azure DevOps https://devblogs.microsoft.com/devops/retirement-of-global-personal-access-tokens-in-azure-devops/