How to determine if an Azure DevOps self-hosted agent is registered using a PAT or Service Principal?

Question

We’re trying to audit our Azure DevOps setup and determine whether our self-hosted agents (in a particular agent pool) are registered using a Personal Access Token (PAT) or a Service Principal (SPN).

From what I’ve researched, the agent pool UI doesn’t reveal this, and I haven’t found a CLI/API way to directly inspect the authentication method used during registration.

Is there a straightforward way to determine how a self-hosted agent was authenticated (PAT vs SPN)? Or is checking the machine-level configuration (e.g., environment variables or setup logs) the only way?

Any help or insights would be appreciated!

Answer 1

Hi Waniya Mustafa

Azure DevOps doesn’t currently expose the authentication method (PAT vs SPN) used during agent registration via the UI, REST API, or CLI.

If you wanted to check then:

1. Navigate to the directory where the agent is installed. This is typically something like C:\agent on Windows or /home/youruser/agent on Linux.
2. Look for a file named .env or env in the agent directory. This file may contain environment variables that indicate whether a PAT or SPN is being used.
3. Open the .agent file (JSON format). It contains metadata like the agent's name, pool, and URL—but not the auth method directly. However, if the agent was registered using a Service Principal, you’ll often find environment variables or scripts.
4. Check the config.log file in the agent directory. It may include like:
   • Using authentication type: PAT
   • Using authentication type: SPN
5. Run config.cmd (Windows) or ./config.sh (Linux/macOS) again. It will prompt for the authentication method. You can cancel after reviewing the current setup.

Hope this helps!

Please Let me know if you have any queries.