Repository navigation
Switch to publishing extensions using Azure Entra IDs instead of PATs #6152
Description
At the end of the year, we won't be able to publish extensions using PATs any more.
Action required: Azure DevOps global PATs are retiring
Global PATs allow a single token to access all Azure DevOps organizations you belong to. To reduce risk from broadly scoped credentials and support regional data requirements, this token type is being retired.
You’re receiving this email because one or more global personal access token(s) associated with your account was used in 1 organization(s) in the last 30 days.
My request to support organization-scoped PATs has not been responded to (microsoft/vsmarketplace#2121).
However, the Publishing Extensions Docs has been updated to say:
Important
On December 1, 2026, global Personal Access Tokens (PATs) in Azure DevOps are retired. To keep publishing extensions, use secure automated publishing with Microsoft Entra ID instead of PATs. For more information, see Retirement of global Personal Access Tokens in Azure DevOps.
We should figure out the best way forward here.
Activity
DanTup commentedon Aug 24, 2026
Comments in nimbus-agent/nimbus-vscode#34 suggest an organization-scoped PAT might work, so perhaps we should test this with the next release (or pre-release).
[-]Switch to secure automated publishing for extensions instead of PATs[/-][+]Switch to publishing extensions using Azure Entra IDs instead of PATs[/+]DanTup commentedon Sep 8, 2026
Re-reading https://code.visualstudio.com/api/working-with-extensions/publishing-extension#secure-automated-publishing-to-visual-studio-marketplace, it seems like we might not need to completely automate this - the instructions show how to generate a Microsoft Entra ID (AAD) access token via Azure CLI. It's not clear what the lifetime of that is, but it might be that at least part of the workflow just needs to be done once and then publishing can still be done from the CLI.Edit: I think this is untrue?(that said, it might still be nice to automate the whole thing)