Azure DevOps Services · git over SSH · Checked October 28, 2026

Azure DevOps over SSH: the post-quantum warning, "Public key authentication failed" and RSA-only keys

Three things that meet people using Git over SSH with Azure DevOps Services in 2026: a warning on every command since OpenSSH 10.1, keys that Azure DevOps refuses without saying why, and Ed25519 keys, which it does not take at all. What ssh.dev.azure.com answered on October 28, 2026, to throwaway keys added to no account, and what Microsoft's Use SSH key authentication (updated June 17, 2026) says.

"WARNING: connection is not using a post-quantum key exchange algorithm"

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

OpenSSH 10.1 and later print this when the server offers no post-quantum key agreement (OpenSSH's explanation). Git for Windows has shipped OpenSSH 10.2 or later since version 2.51.1 of October 2025, so on Windows the warning appears with every git fetch, pull and push over SSH.

On October 28, 2026, ssh.dev.azure.com agreed on diffie-hellman-group-exchange-sha256; bitbucket.org, for comparison, on the post-quantum mlkem768x25519-sha256, with no warning. In a Microsoft Q&A thread from May 2026, a Microsoft moderator answered that Azure DevOps SSH does not yet support post-quantum key exchange, that no timeline has been published, and that the warning can be ignored.

The warning stops nothing: the command goes on. To silence it for Azure DevOps only (OpenSSH recommends doing it selectively), add to ~/.ssh/config (%UserProfile%\.ssh\config on Windows):

Host ssh.dev.azure.com vs-ssh.visualstudio.com
    IgnoreUnknown WarnWeakCrypto
    WarnWeakCrypto no-pq-kex

Keep the IgnoreUnknown line. Windows' own OpenSSH (C:\Windows\System32\OpenSSH, version 9.5) reads the same file and, without it, stops at once with Bad configuration option: warnweakcrypto; with it, both versions connected in our test. For Azure DevOps Server, put your server's host name on the Host line.

"remote: Public key authentication failed."

remote: Public key authentication failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Azure DevOps answered this on October 28 to an RSA key that was in no profile, for a private repository and for a public one alike: over SSH, even a public repository needs a key Azure DevOps knows. The reasons Microsoft gives:

The key is not in your profile (User settings › SSH public keys), or not for the organization of this repository. Compare fingerprints: ssh-keygen -l -E sha256 -f ~/.ssh/id_rsa.pub against the one shown in your profile.
SSH offered another key first. Azure DevOps takes the first key the client offers and does not try the others, so a key in the SSH agent or a GitHub key can come first. Name the key for Azure DevOps and offer only that one:
```
Host ssh.dev.azure.com
    IdentityFile ~/.ssh/id_rsa_azure
    IdentitiesOnly yes
```
For different keys per organization, Microsoft's page shows host aliases (git@devops_fabrikam:v3/…).
The key expired. Then Azure DevOps says so first: remote: Authentication failed: your SSH key has expired. Microsoft sends a notification seven days before. Add a new key; an administrator can also turn off the Validate SSH key expiration policy.

Do not test with ssh -T git@ssh.dev.azure.com alone: the RSA key Azure DevOps did not know still got remote: Shell access is not supported., the same answer a working key gets. Test with git ls-remote on the repository instead.

Ed25519 and ECDSA keys: "Permission denied (password,publickey)"

git@ssh.dev.azure.com: Permission denied (password,publickey).
fatal: Could not read from remote repository.

Azure DevOps takes RSA keys only; Microsoft's page says it "supports RSA keys for SSH authentication" and creates one with ssh-keygen -t rsa -b 3072. On October 28 an Ed25519 key was refused like this before Azure DevOps looked at the repository. Since OpenSSH 9.5, ssh-keygen without -t makes an Ed25519 key, so a freshly made default key is the usual case. Make an RSA key for Azure DevOps and point the Host entry above at it.

The ssh-rsa messages

ssh-rsa is about to be deprecated and your request has been throttled, … your request has been blocked intentionally and You're using ssh-rsa that is unsupported: Microsoft's fix is to remove HostkeyAlgorithms +ssh-rsa from your SSH config, a line older answers told people to add, and let SSH use rsa-sha2-256 or rsa-sha2-512. The RSA key itself stays; only the old SHA-1 signature goes. On October 28 the connection used rsa-sha2-512 with no setting at all.
Unable to negotiate with … port 22: no matching host key type found. Their offer: ssh-rsa: Microsoft says this should not happen on Azure DevOps Services or recent Azure DevOps Server, and gives HostkeyAlgorithms +ssh-rsa for older self-hosted servers only.
Files in Git LFS: Azure DevOps Services does not support LFS over SSH; use HTTPS for those repositories.

Azure DevOps pull requests in IntelliJ IDEA and Rider

Azure DevOps Pull Requests, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, reads the organization, project and repository from an SSH remote (git@ssh.dev.azure.com:v3/…) as well as from an HTTPS one. It talks to Azure DevOps' REST API over HTTPS with its own personal access token or the Azure CLI, so your SSH keys and settings do not matter to it. The review inbox is free; voting, commenting and completing are Pro (US$1 a month, with a 30-day trial).

Get it on JetBrains Marketplace

Azure DevOps is a trademark of Microsoft Corporation; IntelliJ IDEA and Rider are trademarks of JetBrains s.r.o. This page is not affiliated with or endorsed by Microsoft or JetBrains.

More: "fatal: Authentication failed" over HTTPS · Git Credential Manager 3.0 and Azure Repos · 日本語