Microsoft's documentation says Azure DevOps is retiring global personal access tokens, and all existing global PATs stop working on 1 December 2026. Find any token set to all accessible organizations, replace it with an organization scoped PAT or, better, Microsoft Entra authentication, and test each integration before that date.
What a global PAT is
A global PAT works across every organization you can reach in your Entra tenant, rather than being tied to one. That convenience is also the risk. A leaked global token exposes more than a leaked single organization one. Admins already have a tenant policy to restrict global PAT creation, and the retirement ends the type altogether.
What will break
Anything that authenticates with a global PAT will start failing on the date. Microsoft notes that a pipeline, script, package client, or Git operation typically fails the next time it authenticates after a PAT stops working. Common places:
- Build scripts that call REST APIs from a laptop or a build agent
- Package feeds consumed by developer machines and CI
- Third party tools given a token once and forgotten
- Scripts that loop over several organizations with one token
Checklist
- Open Personal access tokens in user settings and set the Access scope filter to see tokens across organizations in the same tenant.
- Note every token whose scope is all accessible organizations.
- For each, record the owner, purpose, scopes, expiry, and dependent integrations. Microsoft recommends keeping this inventory.
- Decide the replacement. For applications and automation, use Microsoft Entra tokens, managed identities, or service principals. For Git use Git Credential Manager. For Azure Artifacts use the Credential Provider.
- If a PAT is unavoidable, create an organization scoped one with only the needed scopes and a short lifetime.
- Store the new value in a secret store, never in a Git remote URL,
.git/config, YAML, or logs. - Update the integration, test it with a nonproduction operation, then revoke the global token.
- Ask admins to enable the tenant policy restricting global PAT creation, so new ones are not created while you migrate.
Rotating without an outage
Microsoft's rotation flow is to create the new token, store it, test one integration, update the rest, test all, and only then revoke the old token. The lifecycle APIs do not regenerate a token in one call, and they need a Microsoft Entra token from a user flow, so service principals cannot manage PATs through them.
Leavers and unknown tokens
Tokens belong to users. When a user is disabled they cannot reach the organization, but the tokens are not deleted. For offboarding, Microsoft points admins to the Token Administration APIs to revoke a user's PATs. If you see an unexpected PAT notification, check whether a tool created it, such as Git or a service hook, and revoke it if you do not recognize it.
Quick check
Will global PATs work after 1 December 2026?
No. Microsoft says all existing global PATs stop working that day.
What replaces a PAT for automation?
Microsoft recommends Microsoft Entra tokens, managed identities, or service principals, and service connections inside pipelines.
Safeguard compliance evidence automation can help document this kind of access review, and a free scan is at gold.safeguard.sh/scan.
Sources
- Use personal access tokens, Microsoft Learn
- Manage personal access tokens using policies, Microsoft Learn
Last reviewed: 19 October 2026.
