Azure DevOps: "TF401444: Please sign-in at least once as … in a web browser to enable access to the service."
Azure DevOps answers TF401444 when a Microsoft Entra token is for an identity that the organization does not know yet. A person fixes it by signing in to the organization once in a browser with that same account, or by using the account that is a member. A service principal or a managed identity cannot open a browser: an administrator adds it to the organization. In public reports, the identity in the message is often not the account people meant to use.
The whole answer
As public reports from 2022 to October 2026 quote it, with HTTP 401 and a JSON body:
TF401444: Please sign-in at least once as <directory>\<directory>\<object ID> in a web browser to enable access to the service.
- The name after "as" is the identity of the token. A service principal or a managed identity shows as its tenant ID twice and its object ID. A person shows as a directory and a sign-in name; a personal Microsoft account shows as
Windows Live ID\name@example.com. - It comes from anything that signs in with Microsoft Entra: the REST API with a token from
az account get-access-tokenor a workload identity, Git Credential Manager (fatal: Failed to create PAT: TF401444: …), the Terraform provider, Argo CD with workload identity (in lower case, afterauthentication required:), the KEDA Azure Pipelines scaler and Backstage. - A call with no token gets TF400813 instead (what that one means).
A person: az login, Git Credential Manager, a tool's Microsoft sign-in
- Check the account. Compare the name after "as" with the account you meant. With the Azure CLI,
az account showshows the signed-in user and its tenant; Git Credential Manager lists the account it remembers for each organization withgit-credential-manager azure-repos list. A personal Microsoft account and a work account with the same email address are two different accounts. - If it is the right account, open
https://dev.azure.com/<organization>in a browser and sign in with it once. Then run the command again. In June 2026, a Python keyring for Azure Artifacts feeds in Microsoft's GitHub organization (artifacts-keyring-nofuss) started to say exactly this for TF401444. - If the browser does not let you in, the account is not a member of the organization: an administrator adds it in Organization settings → Users → Add users.
- If it is the wrong account, sign in with the right one:
az loginagain (with--tenantset to the directory the organization is connected to), or for Git Credential Managergit-credential-manager azure-repos unbind <organization>and then sign in on the next git command. In a 2022 report from Windows, the message named a local Windows account instead of the work account the person typed in.
A service principal or a managed identity
Microsoft's answer for TF401444 is to add the identity to the organization explicitly, give it an access level and grant it what it needs (Use service principals and managed identities, updated September 21, 2026):
- In Azure DevOps, open Organization settings → Users → Add users and enter the display name of the service principal or managed identity. Adding it only to a Microsoft Entra group does not make it known to Azure DevOps.
- Choose the access level and the projects. Azure Repos needs Basic or higher; Stakeholder does not include it.
- If Azure DevOps cannot find a service principal, use the Object ID from Enterprise applications in the Microsoft Entra admin center, not the one from App registrations. The identity must be in the tenant the organization is connected to.
A pipeline's service connection with workload identity federation gets the same answer when its identity was not added: Microsoft's workload identity page lists TF401444 with this fix. Once it is in the organization but not in the project, the next answer is VS800075.
Azure DevOps pull requests in IntelliJ IDEA and Rider
Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, reads the organization, project and repository from your git remote and lists the pull requests that wait for your review in an IDE tool window, on Azure DevOps Services and on Azure DevOps Server. It signs in with a personal access token or with your Azure CLI sign-in (az login). From version 1.0.35, when Azure DevOps answers TF401444 to the Azure CLI sign-in, it says to open the organization in a browser and sign in once with that account, or to run az login with the account that is a member. The review inbox is free; voting, commenting and completing are Pro, with a 30-day trial.
Get it on JetBrains Marketplace
Azure DevOps and Microsoft Entra are trademarks of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.
More: TF400813: the token was not accepted · VS800075: the identity cannot see the project · 日本語