Microsoft retires Azure global personal access tokens

Microsoft is phasing out global personal access tokens (PATs) and replacing them with more secure, scoped, and manageable credentials. These tokens currently grant access to every Azure organization that a user belongs to. You need to update your Azure Repos integrations with Snyk to organization-scoped tokens to maintain your connection.

Upcoming deadlines

• March 15, 2026: Microsoft stops issuing new global personal access tokens.

• December 1, 2026: Microsoft disables all existing global personal access tokens.

Update your connection

1. Generate a new Personal Access Token (PAT) in Azure DevOps. Ensure the token is scoped specifically to the Azure Organizations you need. You can find guidance in the Microsoft documentation.

2. Update the token at both the Groups level and the Organizations level.

   • Log in to Snyk.

   • Navigate to Group-level Integrations and find your Azure Repos integration settings. Create a single profile for each Azure organization and enter the new PAT. This is required for Asset discovery and enrichment.

   • Navigate to Org-level Integrations and find your Azure Repos integration settings. Clear the old token and enter the new PAT. This supports rest of the other Snyk features.

3. If you are using a Snyk Broker, you will also need to follow the setup-specific documentation to set the PAT.

   • Update the token for your Classic Broker.

   • Update the token for your Universal Broker.

Read the Microsoft announcement for more information.