Azure DevOps global personal access tokens: the December 1, 2026 retirement is postponed
A personal access token created with the access scope All accessible organizations is a "global PAT". Microsoft is retiring them in Azure DevOps Services. It had set December 1, 2026; on October 23, 2026 it struck that date out, to avoid disruption during the December holiday season. The retirement itself stands: if Git, a plugin or a script in your JetBrains IDE signs in with one, plan to replace it. Azure DevOps Server is not affected.
What Microsoft announced
From Retirement of Global Personal Access Tokens in Azure DevOps (December 12, 2025, with updates on March 5 and October 23, 2026):
- All existing global PATs are fully decommissioned and then stop working. The date December 1, 2026 is struck out; beside it the post now reads January 27, 2026, with the note that the retirement was postponed to avoid disruption during the December holiday season. That day has already passed, so the year is most likely a slip for 2027: check the post for a correction.
- The earlier plan to block creating them on March 15, 2026 was dropped; they can still be created until they are decommissioned.
- Nothing changes for global PATs in Azure DevOps Server.
- Microsoft recommends short-lived Microsoft Entra sign-in, or tokens for each organization.
Do you have one?
- Open
https://dev.azure.com/<your organization>, then the user settings icon at the top right, then Personal access tokens. - Set Access scope to All accessible organizations and Status to Active.
- What is listed is global. Microsoft also emails users who actively use one.
Replace it
- A token for one organization: create a new personal access token with that organization as its access scope and only the scopes you need. For Git: Code (Read) to pull, Code (Read & write) to push. If you work in several organizations, make one per organization.
- Microsoft Entra sign-in instead of a token: short-lived tokens that are renewed for you, which is Microsoft's recommendation. Microsoft notes that Entra tokens last one hour, so tools that cannot renew them ask you to sign in more often (Modernizing Authentication for Legacy Visual Studio Clients, October 14, 2025).
Git in IntelliJ IDEA and Rider
If the password Git saved for dev.azure.com is a global PAT, pull and push fail once Azure DevOps refuses it. When the server answers 401, Git drops the saved password and asks again (Git's http.c), through the IDE's login window or your credential helper: enter the new organization token there. Git's own message for a 401 is fatal: Authentication failed for '…' (the other reasons for it). Git Credential Manager 3.0 and later signs in with OAuth tokens by default and does not create personal access tokens (what changed in 3.0).
Azure DevOps pull requests in JetBrains IDEs
Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later and Android Studio, signs in either way: a personal access token for the organization (Code (Read & write) to vote, comment and complete; Code (Read) to read), or Use my Azure CLI sign-in (az login) instead of a token, which asks the Azure CLI for a short-lived Entra token and keeps it in memory only (Azure DevOps Services). Reading pull requests is free; voting, commenting and completing are Pro, with a 30-day trial.
Get it on JetBrains Marketplace
Azure DevOps and Microsoft Entra are trademarks of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.
More: az repos pr and signing in to the Azure CLI · Azure DevOps plugins for IntelliJ IDEA 2025.2 and later · 日本語