Implement and manage Azure DevOps service connections and personal access tokens

Azure DevOps provides robust authentication mechanisms to secure pipelines, REST APIs, and integrations. In this guide, we'll explore two critical methods—Service Connections and Personal Access Tokens (PATs)—to help you maintain secure, automated workflows.

Table of Contents

• Service Connections
  • Benefits
  • Creating a Service Connection
  • Managing Service Connections
• Personal Access Tokens (PATs)
  • Generating a PAT
  • Using PATs with cURL and Python
• Service Connections vs. Personal Access Tokens
• Security Best Practices
• References

Service Connections

Service Connections in Azure DevOps let pipelines and services authenticate with external resources—such as Azure Subscriptions, Docker registries, GitHub, and more—without embedding secrets directly in your YAML definitions.

Benefits

• Centralized credential management for all pipelines
• Simplified service authentication in YAML and classic pipelines
• Improved security posture with scoped access

Creating a Service Connection

1. Navigate to Project Settings in your Azure DevOps project.
2. Under Pipelines, select Service connections.
3. Click New service connection and pick the desired type (e.g., Azure Resource Manager, Docker Registry).
4. Complete the authentication prompts and grant the necessary permissions.
5. Save the service connection and reference its name in your pipeline YAML.

Managing Service Connections

• Edit or Update: Go to Service connections, select the connection, update settings, and save.
• Delete: Select the connection and click Delete (project administrator permissions required).

Personal Access Tokens (PATs)

Personal Access Tokens (PATs) are OAuth-like tokens used to access Azure DevOps REST APIs. They are perfect for automation scripts, third-party integrations, and CLI operations.

Generating a PAT

1. Open your Azure DevOps profile and choose Personal Access Tokens.
2. Click New Token, enter a descriptive name, set an expiration date, and select only the scopes you need (e.g., Code (read/write), Work items (read/write)).
3. Click Create, then copy and store the token securely.

Using PATs with cURL

Use your PAT in the Authorization header to interact with the Azure DevOps REST API:

curl -u :<PAT> \
  -H "Content-Type: application/json-patch+json" \
  -X POST \
  -d '[{"op":"add","path":"/fields/System.Title","value":"New Task"}]' \
  https://dev.azure.com/{organization}/{project}/_apis/wit/workitems/$Task?api-version=6.0

Using PATs with Python

Below is a Python script that creates a work item via the REST API using requests and HTTPBasicAuth:

import requests
from requests.auth import HTTPBasicAuth

organization = "yourorganization"
project = "yourproject"
pat = "yourPAT"

url = (
    f"https://dev.azure.com/{organization}/{project}"
    "/_apis/wit/workitems/$Task?api-version=6.0"
)
headers = {"Content-Type": "application/json-patch+json"}
data = [
    {"op": "add", "path": "/fields/System.Title", "value": "New Task"}
]

response = requests.post(
    url,
    json=data,
    headers=headers,
    auth=HTTPBasicAuth("", pat)
)
print(response.json())

Service Connections vs. Personal Access Tokens

Security Best Practices

1. Grant least privilege on both service connections and PATs.
2. Rotate tokens and credentials regularly to reduce exposure.
3. Monitor and audit logs for unauthorized access attempts.
4. Enforce Multi-Factor Authentication (MFA) and conditional access policies.

References

• Azure DevOps Service Connections
• Create and use personal access tokens
• Azure DevOps REST API documentation