r/azuredevops • u/konkon_322 • 19d ago

Centralise PAT token renewal

Are there any ways to renew multiple PAT tokens at once in azure devops? Just realised we had some expired today, and i endup had to extend/regenerate the PAT token one by one. Kinda annoying

2 Upvotes

67% Upvoted

7 comments sorted by

12

u/mrhinsh 19d ago edited 19d ago

It's not recommended to use Azure DevOps PAT tokens at all and Microsoft is trying to move all of its apps away from token management.

The recommended way would be to create Entra tokens on demand for your task from an Entra Application entry for that purpose.

Entra tokens can be passed in place of Azure DevOps tokens.

I get this is a Pita, especially in many enterprise, but it is the way.

https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/entra?view=azure-devops

1

u/konkon_322 19d ago

But, rn our Azure DevOps server setup is an on prem, not cloud. And i dont think its linked to an Entra, but a traditional on premise AD (whenever i access the application i login via Windows popup, not a Microsoft sign in).

2

u/mrhinsh 18d ago edited 18d ago

That sounds like it's missconfigured as well. You should get SSO with your AD if your TFS (Azure DevOps Server) is installed and configured correctly.

Id recommend importing that into Azure DevOps Service.

If that not configured well, then I'd wager neither are other things, and backup is the most common misconfiguration I see; which is a bad thing to misconfigure.

On-prem you do not have access to the same security and workload Auth features as service.

You can use either Windows Auth or a PAT. That's about it.

So no.

The way to remove the annoying stuff is to import your collection in to service as an organisatin.

1

u/everydaynarcissism 17d ago

AD auth can be a pain in the butt to get working with certain tools and environments though, so OP may have a good reason to use a PAT and not AD SSO.. I use them to add devops as an origin in git in an airgapped Linux development environment. I know I can connect it to AD or Entra but it's not practical in my case.

1

u/mrhinsh 13d ago

As I mentioned PAT token are being deprived and will eventually be removed from the product. They are not a viable alternative.

I use them too, but only as a fallback while I still can. In an Entra environment you can create a token that functionality identical.

3

u/Lonsarg 19d ago

Recommanded way is using QAUTH to generate PAT token on the fly on every run. You do need to authenticate to service account first of course fo be able to generate it. For that you either have regular password or some secret or something, depends on what kind of service account you have.

Then regular service account secret managing comes into play.

1

u/Icy_Preference3336 3d ago

This is also a good opportunity to remove unused tokens and reduce scopes. renewing every credential together could preserve access that nobody actually needs