> For the complete documentation index, see [llms.txt](https://knowledgebase.autorabit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.autorabit.com/fundamentals/announcements/azure-devops-global-personal-access-token-retirement-on-december-1-2026.md). # Azure DevOps Global Personal Access Token Retirement on December 1, 2026 ## Microsoft Azure DevOps authentication update Global Personal Access Tokens (PATs) will retire on December 1, 2026. Customers using them with AutoRABIT should move to organization-scoped PATs before that date. No AutoRABIT upgrade is required for this migration. #### Key message for customers This is a Microsoft Azure DevOps platform change. Organization-scoped PATs continue to work with AutoRABIT today, so customers can complete the required migration without waiting for a product release. ## Azure DevOps Global Personal Access Token Retirement **Action required before December 1, 2026** Microsoft is retiring Global Personal Access Tokens (PATs) in Azure DevOps Services. A Global PAT is a token whose access scope is set to **All accessible organizations**. **On** **December 1, 2026, existing Global PATs will stop working**. Organization-scoped PATs are not affected and can continue to be used with AutoRABIT. This change is part of Microsoft’s Azure DevOps authentication updates. No AutoRABIT product upgrade is required to move from a Global PAT to an organization-scoped PAT. #### Who should review this? Review your configuration if AutoRABIT connects to repositories in Azure DevOps Services using a Personal Access Token. You are affected only if the PAT currently used is a Global PAT with the scope **All accessible organizations**. #### How to check whether you use a Global PAT 1. Sign in to your Azure DevOps organization. 2. Open User settings and select Personal access tokens. 3. Filter Access scope to All accessible organizations and Status to Active. 4. Any active token shown in this view is a Global PAT and should be replaced before December 1, 2026. If no active Global PATs are listed, no change is required for this Microsoft retirement. #### What you need to do **1. Identify the Azure DevOps organizations used by your repositories** A Global PAT can be used across multiple Azure DevOps organizations. An organization-scoped PAT is limited to one organization. If your AutoRABIT repositories span multiple Azure DevOps organizations, create a separate organization-scoped PAT for each organization. **2. Create an organization-scoped PAT in Azure DevOps** Create a new PAT and select the specific Azure DevOps organization instead of All accessible organizations. **Recommended permissions:** * **Code - Read, Write and Manage** - Required for repository operations such as commits, merges, CI jobs, deployments, and pull requests. * **Member Entitlement Management - Read** - Required only if you select reviewers when creating pull requests from AutoRABIT. Set the token expiration according to your organization’s security policy and record the expiration date for future rotation. **3. Add the new credential in AutoRABIT** In AutoRABIT, go to **Admin > Credentials** and create a credential for the new organization-scoped PAT. **Credential type**: Username With Password Enter your Azure DevOps user name in the User Name field and the PAT in the Password field. **Tip**: Include the Azure DevOps organization name in the credential name so it is easy to identify which credential belongs to each organization. **4. Update the places that use the credential** Review the following areas and replace the Global PAT credential with the correct organization-scoped credential where applicable: * Admin > Repository Manager * Admin > ALM Management * Admin > User Management for any user-specific repository or ALM credentials * Your own user profile if you have configured a personal repository credential User-specific credentials are important to review because they can override the shared credential configured for a repository or ALM connection. **5. Validate the connection** After updating the credentials, validate your normal Azure DevOps workflows before December 1, 2026. We recommend testing at least one repository operation and one CI workflow for each Azure DevOps organization you use. If you use pull requests from AutoRABIT, also create a test pull request and confirm that the reviewer list loads correctly. #### What is not changing * Organization-scoped PATs continue to be supported. * Existing repositories do not need to be re-registered simply because Microsoft is retiring Global PATs. * No AutoRABIT upgrade is required to replace a Global PAT with an organization-scoped PAT. * Azure DevOps Server connections used for Azure Boards are not affected by Microsoft’s Azure DevOps Services Global PAT retirement. #### Future authentication direction AutoRABIT is also working toward Microsoft Entra ID-based authentication for Azure DevOps Services, aligned with Microsoft’s recommended direction for modern authentication. This capability will be communicated separately when available. **Customers should not wait for this future capability to address the December 1, 2026, Global PAT retirement. Moving to organization-scoped PATs is the supported action available today.** #### Need help? If you need help identifying which AutoRABIT repositories use each Azure DevOps organization, or assistance updating credentials, contact AutoRABIT Support or your Customer Success Manager. #### Reference Microsoft announcement: Retirement of Global Personal Access Tokens in Azure DevOps \ --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://knowledgebase.autorabit.com/fundamentals/announcements/azure-devops-global-personal-access-token-retirement-on-december-1-2026.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.