Cross-platform CLI authentication for Azure DevOps

Azure DevOps Services | Azure DevOps Server | Azure DevOps Server 2022

This article explains authentication approaches for the cross-platform CLI (tfx-cli) and Azure DevOps.

Important

Consider using the more secure Microsoft Entra tokens over higher-risk personal access tokens. For more information, see Reduce PAT usage. Review the authentication guidance to choose the right authentication mechanism for your needs.

Important

Basic authentication is deprecated and not recommended.

Prerequisites

Before you begin, ensure you have:

• Node.js (latest LTS version recommended)

• tfx-cli installed globally:

  npm install -g tfx-cli
  

For more information about tfx-cli, see the Node CLI for Azure DevOps on GitHub.

Authentication methods

The tfx-cli supports the following authentication methods:

Method	Recommended for
PAT	Azure DevOps Services and Azure DevOps Server
Basic Authentication	Azure DevOps Server only (deprecated)

PAT authentication

Use PATs to authenticate with Azure DevOps Services or Azure DevOps Server.

Create and use a PAT

1. Create a PAT with the required scopes.

2. Sign in using the PAT:

   tfx login
   

3. When prompted, provide:

   • Service URL: Your Azure DevOps instance URL.
   • Personal access token: The PAT you created.

Example URLs:

• Azure DevOps Services: https://dev.azure.com/Your_Organization
• Azure DevOps Server: https://yourserver/tfs/DefaultCollection
• Visual Studio Marketplace: https://marketplace.visualstudio.com

Example session:

~$ tfx login
Copyright Microsoft Corporation

> Service URL: https://dev.azure.com/Your_Organization
> Personal access token: **********************
Logged in successfully

Basic authentication (Deprecated)

Warning

Basic authentication is deprecated and not recommended. Use Microsoft Entra ID instead. Basic authentication:

• Sends credentials in plaintext
• Can cause issues with Git command line operations
• Poses security risks

Configure basic authentication (Azure DevOps Server only)

If you must use basic authentication with Azure DevOps Server installations:

1. Enable IIS Basic Authentication:

   • Open Server Manager.
   • Install the Basic Authentication feature for IIS.
   • In IIS Manager, go to your Azure DevOps Server website.
   • Double-click Authentication in the Features view.
   • Enable Basic Authentication.
   • Leave domain and realm settings empty.

2. Sign in with basic authentication:

   tfx login --auth-type basic
   

3. When prompted, provide:

   • Service URL: Your on-premises server URL (for example, http://yourserver:8080/tfs/DefaultCollection).
   • Username: Use domain\username format (for example, fabrikam\john)
   • Password: Your domain password.

Tip

Consider configuring SSL for secure communication when using basic authentication.

Next step

View the complete tfx-cli command reference