blogs-image

Azure DevOps PAT Token Generation: Step-by-Step Guide, Usage, and Best Practices

What is a Personal Access Token (PAT) in Azure DevOps?

A Personal Access Token (PAT) is a secure, time-limited authentication token used to access Azure DevOps REST APIs, Git repositories, and other services. PATs are an alternative to passwords and are recommended for programmatic or command-line access.

  • Enables secure, scoped access to Azure DevOps resources
  • Supports automation, CI/CD pipelines, and integrations
  • Can be limited by scope and expiration for enhanced security

Prerequisites

  • An active Azure DevOps account
  • Appropriate permissions to create PATs (usually any user can create PATs for their own account)
  • Modern web browser

How to Generate a PAT in Azure DevOps

Step-by-Step Instructions
  1. Sign in to Azure DevOps
    Go to https://dev.azure.com/ and log in with your credentials.
  2. Open User Settings
    In the upper right corner, click your profile picture and select Personal access tokens.
  3. Create a New Token
    Click + New Token.
  4. Configure Token Details
    • Name: Enter a descriptive name
    • Organization: Select the Azure DevOps organization
    • Scopes: Choose the minimum required permissions
    • Expiration: Set a suitable expiration period (default is 30 days)
  5. Create and Copy the Token
    Click Create. Copy the token immediately and store it securely. You won't be able to retrieve it again!

Usage Examples

1. Git Command-Line Authentication

Clone a repository using your PAT as the password:

git clone https://dev.azure.com/<organization>/<project>/_git/<repo>
Username: <your Azure DevOps username>
Password: <your PAT>
2. Azure DevOps REST API

Access the REST API with curl:

curl -u :<PAT> https://dev.azure.com/<organization>/_apis/projects?api-version=7.0
3. Azure DevOps CLI

Authenticate the Azure DevOps CLI:

az devops login --organization https://dev.azure.com/<organization>
Enter your PAT when prompted.
4. Pipeline Service Connections

Use a PAT to create a service connection for external tools in your Azure Pipelines.

{
  "authorization": {
    "parameters": {
      "username": "",
      "password": "<PAT>"
    },
    "scheme": "UsernamePassword"
  }
}
5. Integrating with Third-Party Tools

Configure tools like Jenkins or Terraform to authenticate with Azure DevOps using a PAT in their credential settings.

# Example: Jenkins Secret Text Credential
Kind: Secret text
Secret: <PAT>

Security Best Practices

  • Always use the least privilege principle when selecting scopes.
  • Set the shortest practical expiration for each PAT.
  • Store PATs securely using a password manager or secret store.
  • Revoke unused or compromised PATs immediately.
  • Never share PATs or commit them to source code repositories.
  • Monitor usage and audit PAT activity regularly in Azure DevOps.

Feature Comparison: PAT vs. OAuth vs. Service Principal

Authentication Method Best For Expiration Scope Granularity Interactive Login Required?
PAT Personal, script, or tool access Configurable (1 day to 1 year) Fine-grained No
OAuth Web apps, delegated access Short-lived, renewable Fine-grained Yes
Service Principal Automated, non-interactive apps Long-lived, managed via Azure AD Role-based No

Frequently Asked Questions (FAQ)

PATs can be set to expire in 1 day, 1 week, 1 month, 3 months, 6 months, or 1 year. Always choose the shortest duration that meets your needs.

No. For security reasons, PATs are only shown once when created. If lost, you must revoke and create a new one.

All access granted by the PAT is revoked. Any scripts or tools using the expired PAT will fail to authenticate.

Go to User Settings > Personal access tokens, find the PAT, and click Revoke.

Yes, PATs can be used for most Azure DevOps REST APIs, Git, and pipeline integrations. Some advanced scenarios may require OAuth or Service Principals.

Further Reading