Home / Azure

AzureTroubleshootingBeginner

Azure DevOps sign-in and access errors - is it a service outage or your tenant? A 10-minute triage

When users suddenly can't reach Azure DevOps, first decide whether it's a service incident or something in your tenant - Conditional Access, expired PATs, organisation policies or network. Then fix the right thing and keep pipelines running with the CLI extension patched.

Deepak Bhardwaj3 min read

Applies toAzure DevOps Services (dev.azure.com); Microsoft Entra ID; Azure DevOps CLI extension; self-hosted and Microsoft-hosted agents

Typical reports

  • "TF400813: The user is not authorized to access this resource"
  • 401 or 403 from git clone or the REST API
  • Sign-in loops, or "You need permission" after signing in
  • Pipelines queued but agents offline, or service connections failing

On 21 October 2026, for example, users in several countries reported Azure DevOps access errors while the general Azure status page showed no broad Azure outage. The first job is to tell the two cases apart.

Step 1: Is it the service?

  1. Check status.dev.azure.com. Azure DevOps has its own status page, separate from the Azure status page.
  2. Ask: is it everyone, or one team / one location / one authentication method?
  3. Try from a different network (a phone hotspot) and a private browser window.
Pattern Likely cause
Everyone, all locations, status page shows an incident Service incident: wait, communicate, don't change settings
Only one office or VPN Network, proxy or firewall
Only users covered by a new Conditional Access policy Entra ID policy
Only automation (scripts, pipelines) Expired PAT, service principal secret or workload identity issue
Only one organisation Organisation policy or Entra connection change

Step 2: Tenant-side checks

Entra sign-in logs. Filter by application Azure DevOps (and the user). A failure there shows the exact reason: Conditional Access, MFA, device compliance or an expired password.

az rest --method get \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=appDisplayName eq 'Azure DevOps' and status/errorCode ne 0&\$top=20" \
  --query "value[].{user:userPrincipalName, err:status.errorCode, reason:status.failureReason, ca:conditionalAccessStatus}" -o table

Organisation policies. In Organisation settings > Policies, check whether someone recently changed: third-party OAuth access, SSH authentication, public projects, or IP-based Conditional Access policy validation.

PATs. A PAT that expired or was revoked returns 401 for scripts while browser users are fine. Admins can see PAT lifecycle policy under Organisation settings > Microsoft Entra.

Step 3: Network checks

Azure DevOps uses several host names (dev.azure.com, *.dev.azure.com, *.visualstudio.com, *.vsassets.io, login.microsoftonline.com and others). A proxy or firewall change that blocks one of them breaks sign-in or asset loading in ways that look like permissions errors. Compare with Microsoft's current allowed-domain list and test with:

curl -sI https://dev.azure.com/<org>/_apis/connectionData | head -1

Step 4: Pipelines

  • Agents offline: self-hosted agents need outbound HTTPS to the same host names. Check the agent's _diag logs.
  • Service connections: prefer workload identity federation over secrets; secrets that expire are a common Monday-morning outage.
  • Keep running during a service incident: you can't do much for Microsoft-hosted agents. Have a documented manual deployment path for critical fixes.

Keep the CLI extension patched

A security update for the Azure DevOps CLI extension (CVE-2026-69877) was published on 13 October 2026. Update it on build agents and admin workstations:

az extension update --name azure-devops
az extension show --name azure-devops --query version -o tsv

Checklist

  • status.dev.azure.com checked before changing anything
  • Scope of the problem established (users, locations, auth type)
  • Entra sign-in logs reviewed for the failing users
  • Recent policy, Conditional Access and proxy changes reviewed
  • PATs and service connection secrets checked for expiry
  • Azure DevOps CLI extension up to date on agents

Sources

Related fixes