Azure DevOps Server (on-prem), cannot get past "401 - Uh-oh, you do not have access."

Your account, ********@xxx-xxx.eu is not authorized to view this page. Make sure the URL is correct and your account has access. View a list of your organizations here. You may request access by contacting the admin.

Currently, the only thing that helps is detaching the Project Collection. After reattaching it, I add my user account back to the Project Collection Administrators group, and then it works again. However, this is not really “usable” with this error (and no, it is not due to AD or cache. Everything has already been checked thoroughly). The problem is that the permissions are suddenly gone (on the server).

Unfortunately none of the above does anything.

Would it be possible to get in-person support? We are prepared to pay for services.

Thank you.

Hi @Joseph Choi ,

Thanks for reaching out to Microsoft Q&A.

"401 - Uh-oh, you do not have access" error.

Below are some troubleshooting steps that might help you resolve this error.

1. Check User Access: First, verify that your account is still listed in the Azure DevOps organization's user directory. Sometimes accounts can inadvertently be removed or experience permission issues.
2. Correct Account Type: Make sure you're signing in with the correct User Principal Name (UPN). If you have multiple accounts (work and personal) using the same email, it’s essential to use the UPN that's associated with your Azure DevOps account, for example, ******@contoso.com instead of an alias.
3. Permissions for Projects: Even if you are an admin, check that you still have the necessary permissions for accessing specific projects or resources. Permissions can vary by resource, and it’s possible your account lost some permissions.
4. Sign Out and Clear Credentials: Try completely signing out of Azure DevOps, clearing your browser cookies, and signing back in. You can do this using Incognito or InPrivate mode in your browser.
5. Re-evaluate your Permissions: If recent changes were made to your security group membership or other settings, have you prompted a re-evaluation of your permissions? You can do this within the user settings.
6. Potential AD Issues: Since you mentioned Active Directory (AD), ensure that any group policies or conditional access policies associated with your account or organization are not interfering. Sometimes, issues can arise due to security policies enacted by your organization.
7. Check Application Pool: Since you've already recycled the application pool and restarted IIS, if you can, check the server logs for any indicators why the application may not recognize your account properly.

Here's a reference list linking to relevant documentation that might be helpful:

• Troubleshoot connectivity and signing in
• Capture a browser trace for troubleshooting
• About permissions in Azure DevOps
• Sign-in Issues

I hope this helps!

Hello Joseph Choi,

Thanks for raising this question in the Q&A forum! 401 Unauthorized in Azure DevOps Server (on-premise) typically stems from incorrect PAT encoding, insufficient permissions, or authentication method mismatches. On-premise servers require Basic Auth with Base64-encoded PAT (not plain PAT).​

Quick Fix: Correct PAT Encoding

Azure DevOps Server requires PAT prepended with colon before Base64 encoding:

python
import

Common 401 Causes & Fixes

Verify PAT Permissions

On-premise Server PAT creation:​

Server URL → User Settings → Security → Personal access tokens

Click New Token

Select required scopes (Code: Read/Write, Work Items: Read/Write)

Set expiration (max 1 year for on-premise)

Copy token immediately (shown only once)

Test Authentication

bash
# PowerShell - Windows

bash
# curl - Linux/Mac

On-Premise Specific Issues

• IIS Authentication: Ensure Anonymous Authentication enabled in IIS for REST API endpoints​
• Windows Auth conflict: Disable Windows Authentication if using PAT​
• API version: Use api-version=6.0 or 5.0 for Server 2020/2019 (not 7.x)​
• Collection path: Include /tfs/CollectionName/ in URL (not just /)​

Debugging Steps

Test PAT in browser: https://:{PAT}@your-server.com/tfs/DefaultCollection/_apis/projects

Check server logs: C:\Program Files\Azure DevOps Server 2022\Application Tier\Web Services\_tfs_data\Logs

Verify account: Navigate to https://your-server.com/tfs/_admin/_security

1. Confirm collection access: User must be in Project Collection Valid Users

Alternative: Alternate Authentication

If PAT fails, use NTLM/Negotiate (Windows environments):​

python
import

If helpful, kindly accept the answer.

Cheers,

Jerald Felix