Implement and manage Azure DevOps service connections and PATs

Service connections

A service connection stores how a pipeline authenticates to an external system. For a new Azure Resource Manager connection, Microsoft recommends workload identity federation with an app registration or managed identity. It uses a federated credential and removes secret management; other schemes remain for compatibility and edge cases.

Two authorisation controls matter:

Pipeline permissions — authorise each pipeline individually. The "grant access permission to all pipelines" option covers all existing and future pipelines and is not recommended.
Checks — a service connection is a protected resource, so its owner can attach approvals and checks.
Azure role assignment — for an ARM connection, the role assigned to the underlying identity controls what it can do at the Azure target.

For eligible Azure-public-cloud WIF connections using a single-tenant app or managed identity, the Azure DevOps issuer retires July 1, 2027. Convert an affected existing connection to the Microsoft Entra issuer rather than recreating it. Non-public clouds and multitenant applications are outside this deprecation; new eligible connections use the Entra issuer.

Personal access tokens

A PAT is a user credential. Scope it minimally and set a short lifespan. Use one only for personal, temporary, legacy, or Azure DevOps Server scenarios where stronger options do not apply; prefer a service connection, managed identity, or service principal for durable automation where supported.

Revoke PATs during offboarding. Disabling the user's account also revokes its PATs, although processing can take up to one hour.

Primary sources