Azure DevOps: "TF30063: You are not authorized to access …"
Azure DevOps refused the sign-in of a program built on its older client: Visual Studio's Team Explorer, the Azure DevOps add-in for Excel, the tf command line, or a tool built on those libraries. Behind it is HTTP 401. The browser often still works with the same account, because the program keeps its own saved sign-in, and that one was refused. The most common reason is a password change.
Where it shows up
Excel, Open in Excel (microsoft/vsts-open-in-excel issue 34, October 2025): TF30063: You are not authorized to access https://dev.azure.com/<organization> Visual Studio 2026, Output window (MSAL.NET issue 5885, March 2026): TF30063: You are not authorized to access <name>.visualstudio.com\<name> A .NET tool (azure-devops-migration-tools issue 3225, October 2026): Microsoft.TeamFoundation.TeamFoundationServerUnauthorizedException: TF30063: You are not authorized to access https://dev.azure.com/<organization>/. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized.
Tools on the newer .NET client report the same refusal as VS30063.
After a password change: the token Visual Studio stored
Microsoft lists this as a known issue in Resolve common Azure DevOps Office integration issues (updated August 13, 2026). After a network password change, the token stored by Visual Studio is no longer valid, but it is not refreshed. It expires in the end, after a delay Microsoft calls unpredictable. To remove it now, close every Excel window and run this in a Command Prompt opened as administrator:
reg export HKEY_CURRENT_USER\SOFTWARE\Microsoft\VSCommon\14.0\ClientServices\TokenStorage\VisualStudio\VssApp %TEMP%\oicreds.reg
reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\VSCommon\14.0\ClientServices\TokenStorage\VisualStudio\VssAppThe first line keeps a copy of the key. Excel then asks you to sign in when it connects. The same page says to repeat this after each password change if it keeps happening. On Microsoft Q&A, a user who opened a query in Excel from the web wrote in December 2025 that deleting the VssApp key fixed it after a password change; in an older thread from 2023, the error went away by itself after about seven days.
In Visual Studio
- Sign in again under File → Account Settings, as a Microsoft moderator suggested on Q&A in March 2025.
- If that is not enough, an answer by Microsoft support staff on Q&A (May 2024, Visual Studio 2022 after a password reset) says to close every Visual Studio window and delete two cache folders, then start Visual Studio again:
%localappdata%\.IdentityServiceand%localappdata%\Microsoft\Team Foundation\<version>\Cache. - In the Visual Studio 2026 report above, signing in brought up a Windows sign-in (WAM) error, "Account has previously been signed out of this application."; choosing Continue signed in.
The other causes Microsoft lists
For TF30063, the Office page points to Microsoft's TF31003 page, which lists these causes:
- You use more than one Microsoft account with Azure DevOps, and another one was cached.
- The password expired in Active Directory or Microsoft Entra. A service still using an old password can also lock the account for a while.
- The browser kept a cookie from old credentials.
- The account lacks permission to connect, or, on Azure DevOps Services, an active license.
In tools built on the client libraries
- An expired personal access token in the tool's settings. One pull request in the migration tools replaced a token that had expired and caused the TF30063 failures in its tests. Azure DevOps shows each token's expiry under User settings → Personal access tokens.
- With Microsoft Entra sign-in through a credential chain, the token can come from another account than the one you meant. In issue 3225, 2 of 40 runs failed at the first connection and passed when run again; the cause was not proven.
The Open in Excel issue from October 2025 was closed in May 2026 for lack of activity, with no fix given, and another user reported the same in July 2026.
Azure DevOps pull requests in IntelliJ IDEA and Rider
Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, signs in to the REST API with its own personal access token, kept in the IDE's password safe, or with the Azure CLI, and works with Azure DevOps Server 2019 and later and TFS 2018 Update 2. When Azure DevOps refuses the token, it says so and names the usual reasons: expired, without the Code scope, or made for "All accessible organizations". The review inbox is free; voting, commenting and completing are Pro (US$1 a month, with a 30-day trial).
Get it on JetBrains Marketplace
Azure DevOps, Visual Studio and Excel are trademarks of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.
More: "VS30063: You are not authorized to access https://dev.azure.com" · git: "fatal: Authentication failed" · 日本語