Azure Pipelines · git over HTTPS · Checked November 3, 2026

Azure DevOps: "fatal: could not read Username for 'https://dev.azure.com'"

git had no credential for the request and tried to ask for one, but a pipeline has no one to answer. This is different from "Authentication failed", where a token was sent and refused: here no token went out at all.

What it looks like

fatal: could not read Username for 'https://dev.azure.com': terminal prompts disabled

The text after the last colon depends on how git was started: "terminal prompts disabled" when the agent sets GIT_TERMINAL_PROMPT=0, "No such device or address" without a terminal. The URL in the message can include the organization, project and repository.

1. The checkout step left no token for your script

The checkout step fetches with the pipeline's token and then removes it. From the YAML reference: persistCredentials, "Set to 'true' to leave the OAuth token in the Git config after the initial fetch. The default is not to leave it." So a later git fetch, git pull or git push in a script has nothing to send. A pipeline in roseout failed this way and was fixed by adding that one line to its full-history checkout (roseout #4259):

steps:
- checkout: self
  persistCredentials: true

To push, the token also needs write access: in Project settings, Repositories, Security, give <project name> Build Service (<organization>) Contribute, and Create branch or Create tag if the script makes them. Without that the push gets TF401027 instead of this message.

For another repository, Microsoft's documentation sends the token as a header, with no token in the URL:

git clone -c http.extraheader="AUTHORIZATION: bearer $(System.AccessToken)" <clone URL>

If the token cannot reach that repository, the answer is usually TF401019, not a user name prompt.

2. A partial clone fetches blobs without the token

With fetchFilter: blob:none, git downloads file contents later, when a command needs them, and the agent passes its header to some git commands but not all. azure-pipelines-agent #5624 shows the cleanup the agent runs on an existing workspace failing:

fatal: could not read Username for 'https://dev.azure.com/<org>/<project>/_git/<repo>': terminal prompts disabled
fatal: could not fetch 5f336811b12b22db0d8b76a5b1e5bf42622e77a5 from promisor remote
##[error]Git sparse checkout disable failed with exit code: 128

A common trigger, from the proposed fix (azure-pipelines-agent #5701, open): job A checks out with fetchFilter: blob:none and sparseCheckoutDirectories, job B checks out the same repository in the same workspace without them, and job B fails while undoing A's sparse checkout.
The variable ADD_FORCE_CREDENTIALS_TO_GIT_CHECKOUT_ENHANCED: true covers the checkout itself but not that cleanup, per the same issue.
It needs a workspace that is reused: self-hosted agents and Managed DevOps Pools with stateful workspaces. Microsoft-hosted agents start each job with an empty one.
Until a fix ships, a fresh workspace avoids the cleanup: workspace: clean: all on the job that fails deletes the old clone before the checkout.

3. A token in the URL, dropped after a curl security update

If the line above says warning: redirecting to, git had the token and threw it away. The fix for curl's CVE-2026-94266, shipped in Ubuntu's curl updates in October 2026, makes git up to 2.56.0 think it was redirected and start over from the URL without its credentials (Ubuntu bug 2171054). It hits scripts that write $(System.AccessToken) or a personal access token into the clone URL. A report in runner-images #15014 shows Microsoft-hosted Ubuntu agents failing on image 20261018.339.1 and passing on 20261012.334.1; the images are shared with GitHub Actions. Send the token as the header above instead. The details and versions are on the GitHub Actions page for the same message.

On your own machine

git found no stored credential and could not open a prompt, for example in a terminal inside an IDE without Git Credential Manager. Sign in once through Git Credential Manager, or store a personal access token in the credential helper you use. If a token is stored and refused, the message is "Authentication failed" instead.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, signs in to the REST API with its own personal access token, kept in the IDE's password safe apart from git's, or with the Azure CLI. The review inbox is free; voting, commenting and completing are Pro (US$1 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Azure DevOps is a trademark of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: "fatal: Authentication failed for 'https://dev.azure.com/…'" · "TF401027: You need the Git 'GenericContribute' permission" · "TF401019: The Git repository … does not exist" · 日本語