Implement and manage Azure DevOps service connections and personal access tokens

​

Table of Contents

• Service Connections
  • Benefits
  • Creating a Service Connection
  • Managing Service Connections
• Personal Access Tokens (PATs)
  • Generating a PAT
  • Using PATs with cURL and Python
• Service Connections vs. Personal Access Tokens
• Security Best Practices
• References

​

Service Connections

​

Benefits

• Centralized credential management for all pipelines
• Simplified service authentication in YAML and classic pipelines
• Improved security posture with scoped access

​

Creating a Service Connection

1. Navigate to Project Settings in your Azure DevOps project.
2. Under Pipelines, select Service connections.
3. Click New service connection and pick the desired type (e.g., Azure Resource Manager, Docker Registry).
4. Complete the authentication prompts and grant the necessary permissions.
5. Save the service connection and reference its name in your pipeline YAML.

​

Managing Service Connections

• Edit or Update: Go to Service connections, select the connection, update settings, and save.
• Delete: Select the connection and click Delete (project administrator permissions required).

​

Personal Access Tokens (PATs)

​

Generating a PAT

1. Open your Azure DevOps profile and choose Personal Access Tokens.
2. Click New Token, enter a descriptive name, set an expiration date, and select only the scopes you need (e.g., Code (read/write), Work items (read/write)).
3. Click Create, then copy and store the token securely.

​

Using PATs with cURL

curl -u :<PAT> \
  -H "Content-Type: application/json-patch+json" \
  -X POST \
  -d '[{"op":"add","path":"/fields/System.Title","value":"New Task"}]' \
  https://dev.azure.com/{organization}/{project}/_apis/wit/workitems/$Task?api-version=6.0

​

Using PATs with Python

import requests
from requests.auth import HTTPBasicAuth

organization = "yourorganization"
project = "yourproject"
pat = "yourPAT"

url = (
    f"https://dev.azure.com/{organization}/{project}"
    "/_apis/wit/workitems/$Task?api-version=6.0"
)
headers = {"Content-Type": "application/json-patch+json"}
data = [
    {"op": "add", "path": "/fields/System.Title", "value": "New Task"}
]

response = requests.post(
    url,
    json=data,
    headers=headers,
    auth=HTTPBasicAuth("", pat)
)
print(response.json())

​

Service Connections vs. Personal Access Tokens

​

Security Best Practices

1. Grant least privilege on both service connections and PATs.
2. Rotate tokens and credentials regularly to reduce exposure.
3. Monitor and audit logs for unauthorized access attempts.
4. Enforce Multi-Factor Authentication (MFA) and conditional access policies.

​

References

• Azure DevOps Service Connections
• Create and use personal access tokens
• Azure DevOps REST API documentation