Sign in with a personal access token

Azure DevOps Services

This article explains how to sign in using an Azure DevOps personal access token (PAT). You can sign in interactively with Microsoft Entra through the az login command or by using an Azure DevOps PAT. To create a PAT, see Use personal access tokens.

Important

We recommend the more secure Microsoft Entra tokens over higher-risk personal access tokens. Learn more about our efforts to reduce PAT usage. Review our authentication guidance to choose the right authentication mechanism for your needs.

To use a PAT with the Azure DevOps CLI, choose one of these methods:

• Run az devops login and enter the PAT token when prompted.
• Pipe the PAT token to StdIn and use it with az devops login.

  Note

  This method works only in a non-interactive shell.

• Set the AZURE_DEVOPS_EXT_PAT environment variable and run CLI commands without using az devops login.

Sign in with az devops login and enter your PAT

After you run the az devops login command, enter your personal access token (PAT) when prompted:

az devops login --organization https://dev.azure.com/contoso
Token:

If you already signed in interactively with az login or used a user name and password, you don't need to provide a PAT. The az devops commands now support sign-in through az login.

When you sign in successfully, this command can also set your default organization if none is configured.

Note

For Guest Users, only az devops login is supported.

Pipe a PAT to az devops login

You can provide your PAT to the Azure DevOps CLI by piping it to the az devops login command. This approach is useful for automation and CI/CD pipelines where interactive input isn't possible.

Use a variable

Replace ###### with $(System.AccessToken) or another pipeline variable:

echo "######" | az devops login --organization https://dev.azure.com/contoso/

Use a file

You can also store your PAT in a file and pipe it to the login command:

cat my_pat_token.txt | az devops login --organization https://dev.azure.com/contoso/

Authenticate with the AZURE_DEVOPS_EXT_PAT environment variable

For non-interactive or automation scenarios, set the AZURE_DEVOPS_EXT_PAT environment variable to your PAT. If you haven't used az login or az devops login, all az devops commands attempt to use this variable for authentication.

Set the environment variable at the process level before running CLI commands to enable seamless authentication.

Windows

# set environment variable for current process
$env:AZURE_DEVOPS_EXT_PAT = 'xxxxxxxxxx'

macOS and Linux

export AZURE_DEVOPS_EXT_PAT=xxxxxxxxxx

Replace xxxxxxxxxx with your PAT.