Add release notes for PAT

Author: gloridelmorales

release-notes/2026/includes/general/sprint-271-update-links.md

@@ -6,4 +6,5 @@ ms.topic: include
 ---
 
 - [Remote MCP Server Public Preview](#remote-mcp-server-public-preview)
-- [Allow extensions to access local network resources](#allow-extensions-to-access-local-network-resources)
+- [Allow extensions to access local network resources](#allow-extensions-to-access-local-network-resources)
+- [Expired personal access tokens (PATs) can no longer be modified](#expired-personal-access-tokens-pats-can-no-longer-be-modified)

release-notes/2026/includes/general/sprint-271-update.md

@@ -31,3 +31,11 @@ Some web browsers may block calls from iframes to resources on the local network
 
 > [!div class="mx-imgBorder"]
 > ![Screenshot showing allow extensions to access local network resources policy.](../../media/271-general-01.png "Screenshot showing allow extensions to access local network resources policy.")
+
+### Expired personal access tokens (PATs) can no longer be modified
+
+We’ve closed a discovered gap in Personal Access Token (PAT) behavior that allowed certain expired PATs to be altered or extended after their expiration date. Going forward, expired PATs cannot be modified or extended via either the Azure DevOps UI or PAT APIs at all in the Azure DevOps Services product.
+
+This change enforces true token lifetimes, reduces risk from leaked or forgotten credentials, and makes PAT behavior simpler and more predictable. It also helps customers meet internal security and compliance expectations by ensuring credentials cannot silently persist beyond their intended lifetime.
+
+If a PAT expires, create a new token or regenerate the existing token. Always use short‑lived PATs and consider migrating to Microsoft Entra–based authentication where supported.

release-notes/features-timeline-released.md

@@ -38,9 +38,10 @@ You can also [view the build numbers for each version](#azure-devops-server-buil
         </tr>
     </thead>
 <tr>
-    <td rowspan="7"><a href="2026/sprint-271-update.md" data-raw-source="[31 March 2026](2026/sprint-271-update.md)">March 31 2026</a></td>
+    <td rowspan="8"><a href="2026/sprint-271-update.md" data-raw-source="[31 March 2026](2026/sprint-271-update.md)">March 31 2026</a></td>
     <td>Permissions enforcement in security overview</td><td>GitHub Advanced Security for Azure DevOps</td><td>N/A</td></tr>
     <td>Remote MCP Server Public Preview</td><td>General</td><td>Future</td></tr>
+    <td>Expired personal access tokens (PATs) can no longer be modified</td><td>General</td><td>Future</td></tr>
     <td>Allow extensions to access local network resources</td><td>General</td><td>Future</td></tr>
     <td>Increased inherited process limit</td><td>Boards</td><td>Future</td></tr>
     <td>Improved continuous deployment visibility in YAML pipelines</td><td>Pipelines</td><td>Future</td></tr>