Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure DevOps Services
This article explains how to sign in using an Azure DevOps personal access token (PAT). You can sign in interactively with Microsoft Entra through the az login command or by using an Azure DevOps PAT. To create a PAT, see Use personal access tokens.
Important
Consider using the more secure Microsoft Entra tokens over higher-risk personal access tokens. For more information, see Reduce PAT usage. Review the authentication guidance to choose the right authentication mechanism for your needs.
Prerequisites
| Category | Requirements |
|---|---|
| Access levels | At least Basic access. |
| Permissions | Member of the Project Collection Valid Users group. |
| Tokens | A personal access token (PAT) with the appropriate scopes for the commands you want to run. |
| Tools | Azure CLI with the Azure DevOps CLI extension. |
To use a PAT with the Azure DevOps CLI, choose one of the following methods:
- Run
az devops loginand enter the PAT when prompted. - Pipe the PAT to stdin and use it with
az devops login.Note
This method works only in a non-interactive shell.
- Set the
AZURE_DEVOPS_EXT_PATenvironment variable and run CLI commands without usingaz devops login.
Sign in with az devops login and enter your PAT
Run the az devops login command and enter your PAT when prompted:
az devops login --organization https://dev.azure.com/contoso
Token:
If you already signed in interactively with az login, you don't need to provide a PAT. The az devops commands support sign-in through az login.
When you sign in successfully, this command can also set your default organization if none is configured.
Note
For Guest Users, only az devops login is supported.
Pipe a PAT to az devops login
You can provide your PAT to the Azure DevOps CLI by piping it to the az devops login command. This approach is useful for automation and CI/CD pipelines where interactive input isn't possible.
Use a variable
Replace ###### with $(System.AccessToken) or another pipeline variable:
echo "######" | az devops login --organization https://dev.azure.com/contoso/
Use a file
You can also store your PAT in a file and pipe it to the login command:
cat my_pat_token.txt | az devops login --organization https://dev.azure.com/contoso/
Authenticate with the AZURE_DEVOPS_EXT_PAT environment variable
For non-interactive or automation scenarios, set the AZURE_DEVOPS_EXT_PAT environment variable to your PAT. If you haven't used az login or az devops login, all az devops commands attempt to use this variable for authentication.
Set the environment variable at the process level before running CLI commands to enable seamless authentication.
# set environment variable for current process
$env:AZURE_DEVOPS_EXT_PAT = 'xxxxxxxxxx'