When will Azure DevOps SSH support post-quantum key exchange?

Question

I am using Git over SSH with Azure DevOps via ssh.dev.azure.com.

With OpenSSH 10.2, Git operations show a warning that the connection is not using a post-quantum key exchange algorithm. When testing the SSH endpoint, Azure DevOps appears to offer only classical Diffie-Hellman key exchange algorithms, not post-quantum or hybrid algorithms such as mlkem768x25519-sha256.

My question is: does Azure DevOps SSH currently support post-quantum or hybrid key exchange? If not, is there a planned timeline or roadmap for adding support for ML-KEM/Kyber or another post-quantum SSH key exchange algorithm?

Given Azure DevOps' role as a major enterprise development platform, we would expect support for modern security features like post-quantum or hybrid SSH key exchange, or at least a clear roadmap for when such support will be available.

Answer 1

I think Azure DevOps SSH has no PQC / hybrid KEX support today, and Microsoft has not published any timeline for adding it.

Answer 2

Hello Raphael,

Thank you for reaching out on the Microsoft Q&A portal.

You are correct in your observation. Currently, the Azure DevOps Microsoft-hosted Git SSH endpoint (ssh.dev.azure.com) relies on classical key exchange algorithms (such as Diffie-Hellman and ECDH) and does not yet support post-quantum or hybrid key exchange algorithms (like mlkem768x25519-sha256 or sntrup761x25519-sha512).

When connecting with OpenSSH versions 10.1 or 10.2, the SSH client proactively warns users if a post-quantum Key Encapsulation Mechanism (KEM) is not negotiated. Although this warning is shown, your connection is still securely established using the standard, supported SSH encryption algorithms.

According to the official Azure Repos - Use SSH key authentication documentation:

We currently support the following public key types:

• RSA
• DSA
• ECDSA
• ED25519"

Presently, there is no publicly published timeline or roadmap for adding Post-Quantum Cryptography (PQC) algorithms to Azure DevOps SSH. As Microsoft continues to align with NIST post-quantum standards across its infrastructure, we expect future updates to eventually cover Azure Repos endpoints.

If this feature is a priority/blocker for your enterprise, we highly recommend submitting an active feature request directly on the Visual Studio Developer Community. The product engineering teams actively monitor these requests to prioritize roadmap additions based on community impact.

In the meantime, the connection remains highly safe under current cryptographic standards, and the OpenSSH warning can simply be ignored.

Hope this helps clarify the current state! Let us know in comments if you have any follow-up questions.

Note: This response is generated with the help of AI systems.