Azure DevOps offers four tenant policies and one organization policy for personal access tokens: restrict global PATs, restrict full scoped PATs, enforce a maximum lifespan, automatically revoke leaked PATs, and restrict PAT creation per organization. Four are off by default. Only the leaked token policy is on.
The policies at a glance
| Policy | Level | Default | Effect |
|---|---|---|---|
| Restrict global personal access token creation | Tenant | Off | New PATs must be tied to specific organizations |
| Restrict full-scoped personal access token creation | Tenant | Off | New PATs must use a custom set of scopes |
| Enforce maximum personal access token lifespan | Tenant | Off | Sets a maximum lifetime in days for new PATs |
| Automatically revoke leaked personal access tokens | Tenant | On | Revokes PATs found in public GitHub repositories |
| Restrict personal access token (PAT) creation | Organization | Off | Controls who can create and regenerate PATs |
Tenant policies are managed by an Azure DevOps Administrator under Organization settings, then Microsoft Entra. The organization policy is managed by a Project Collection Administrator under Policies, and it is only available for Entra backed organizations.
Allowlists and exceptions
Each policy has its own allowlist. People or groups on it are exempt. Microsoft advises using groups, because a named user adds an identity reference stored in the United States, Europe, and Southeast Asia. To exempt someone from every policy, add them to every list.
The organization policy has a sub option to allow creation of PATs with packaging scope only, because many packaging scenarios still rely on PATs. The policy also blocks use of global PATs in the organization unless the user is allowlisted.
What the policies do not do
Existing PATs, created through the UI or APIs, stay valid for their remaining life. To comply, they have to be regenerated or replaced. Also, none of this changes the fact that a PAT is tied to a user, so a token stops working in terms of access when the user is disabled, but is not deleted automatically.
A rollout order that avoids breaking builds
- Inventory current PATs, their owners, scopes, and which pipelines or tools depend on them.
- Replace PATs used by automation with Microsoft Entra tokens, managed identities, or service principals where possible. Microsoft advises avoiding PATs when a stronger method exists.
- Turn on the restriction on full scoped PATs.
- Set a maximum lifespan. Pick a number your teams can live with, then tighten.
- Turn on the organization creation policy in organizations that do not need PATs, with the packaging sub option if needed.
- Leave automatic revocation of leaked PATs on. Microsoft warns that disabling it keeps leaked tokens active, though you still get an email.
Watch the calendar
Microsoft states that global PATs stop working on 1 December 2026. See the next post on global PAT retirement.
Quick check
Do these policies cancel existing tokens?
No. Existing PATs remain valid for the rest of their lifespan. Update them to comply before they need renewal.
Which policy is on by default?
Automatic revocation of leaked PATs. The other policies listed here default to off.
Safeguard dependency scanning and compliance evidence automation can support the review work around credentials, and you can run a free scan at gold.safeguard.sh/scan.
Sources
- Manage personal access tokens using policies, Microsoft Learn
- Use personal access tokens, Microsoft Learn
Last reviewed: 19 October 2026.
