Merge pull request #9048 from MicrosoftDocs/users/chcomley/final-pat

v-dirichards · web-flow · commit 9ad0f982032e · 2026-03-24T12:44:57.000-05:00
Final PAT-reduction touches
diff --git a/docs/artifacts/nuget/nuget-exe.md b/docs/artifacts/nuget/nuget-exe.md
@@ -4,6 +4,7 @@ description: Learn how to connect to Azure Artifacts feeds with NuGet CLI.
 ms.assetid: 10665DBC-846E-4192-8CAB-D5A4C6E40C65
 ms.service: azure-devops-artifacts
 ms.topic: how-to
+ms.custom: pat-reduction
 ms.date: 04/08/2025
 monikerRange: "<=azure-devops"
 "recommendations": "true"
diff --git a/docs/artifacts/quickstarts/github-actions.md b/docs/artifacts/quickstarts/github-actions.md
@@ -2,7 +2,7 @@
 title: Use GitHub Actions to push to Azure Artifacts
 description: Push a NuGet package to Azure Artifacts with a GitHub Actions workflow
 ms.author: jukullam
-ms.custom: github-actions-azure
+ms.custom: github-actions-azure, pat-reduction
 ms.date: 01/14/2026
 monikerRange: azure-devops
 author: juliakm
@@ -32,7 +32,7 @@ You can authenticate by using either a managed identity or a [Personal Access To
 - Permission to assign a managed identity to the **Contributor** group in Azure DevOps. **Project Administrators** and **Collection Administrators** both have this permission. 
 
 > [!NOTE]
-> An alternative approach is to use an Microsoft Entra application with a service principal and federated authentication credential to connect Azure DevOps and GitHub Actions. To learn more about this approach, see [Configure an app to trust an external identity provider](/entra/workload-id/workload-identity-federation-create-trust). 
+> An alternative approach is to use a Microsoft Entra application with a service principal and federated authentication credential to connect Azure DevOps and GitHub Actions. To learn more about this approach, see [Configure an app to trust an external identity provider](/entra/workload-id/workload-identity-federation-create-trust). 
 
 ## Assign permissions to your managed identity in Azure DevOps 
 
diff --git a/docs/artifacts/universal-packages/project-setup-universal-packages.md b/docs/artifacts/universal-packages/project-setup-universal-packages.md
@@ -3,6 +3,7 @@ title: Connect to an Azure Artifacts feed - Universal Packages
 description: Lean how to set up your project and connect to an Azure Artifacts feed to manage your Universal Packages.
 ms.service: azure-devops-artifacts
 ms.topic: how-to
+ms.custom: pat-reduction
 ms.date: 01/22/2025
 monikerRange: 'azure-devops'
 ---
@@ -48,7 +49,7 @@ Ensure that you have Azure CLI installed, then follow the steps below to install
 
     ### [Windows](#tab/windows/)
     
-    1. Run the following command to log into the Azure CLI:
+    1. Run the following command to sign in to the Azure CLI:
     
         ```azurecli
         az login
diff --git a/docs/cli/azure-devops-cli-in-yaml.md b/docs/cli/azure-devops-cli-in-yaml.md
@@ -4,7 +4,7 @@ titleSuffix: Azure DevOps
 description: Learn how to use Azure DevOps CLI with a YAML pipeline with these examples that show how to run Azure DevOps CLI commands.
 ms.topic: how-to
 ms.subservice: azure-devops-reference
-ms.custom: devx-track-azurecli, linux-related-content
+ms.custom: devx-track-azurecli, linux-related-content, pat-reduction
 ms.manager: mijacobs 
 ms.author: chcomley  
 author: chcomley
diff --git a/docs/cli/entra-tokens.md b/docs/cli/entra-tokens.md
@@ -4,6 +4,7 @@ title: Issue Entra tokens with Azure CLI
 description: Use Microsoft Entra authentication on top of Azure CLI
 ms.assetid: 19285121-1805-4421-B7C4-63784C9A7CFA
 ms.subservice: azure-devops-security
+ms.custom: pat-reduction
 monikerRange: 'azure-devops'
 ms.author: chcomley
 author: chcomley
diff --git a/docs/extend/develop/auth-schemes.md b/docs/extend/develop/auth-schemes.md
@@ -3,6 +3,7 @@ title: Authentication Schemas for Service Endpoints | Extensions for Azure DevOp
 description: Find the different ways to authenticate with external services using service endpoints in Azure DevOps extensions.
 ms.assetid: bffc76b7-f6ba-41f0-8460-ccb44d45d670
 ms.subservice: azure-devops-ecosystem
+ms.custom: pat-reduction
 ms.topic: overview
 monikerRange: '<= azure-devops'
 ms.author: chcomley
diff --git a/docs/integrate/concepts/dotnet-client-libraries.md b/docs/integrate/concepts/dotnet-client-libraries.md
@@ -4,7 +4,7 @@ description: Learn how to use Azure DevOps .NET client libraries to integrate wo
 ms.assetid: 474cdb4f-9a5e-49fb-84b2-9c540ebcf98b
 ai-usage: ai-assisted
 ms.subservice: azure-devops-ecosystem
-ms.custom: devx-track-dotnet
+ms.custom: devx-track-dotnet, pat-reduction
 ms.topic: overview
 monikerRange: '<= azure-devops'
 ms.author: chcomley
diff --git a/docs/integrate/concepts/migration-guide.md b/docs/integrate/concepts/migration-guide.md
@@ -4,6 +4,7 @@ titleSuffix: Azure DevOps Services
 description: Step-by-step migration guide for upgrading from legacy WIT Client OM to modern REST-based .NET client libraries with secure authentication.
 ms.subservice: azure-devops-ecosystem
 ai-usage: ai-assisted
+ms.custom: pat-reduction
 ms.topic: overview
 ms.assetid: 30272A34-2CE1-41B3-BA7A-815D69309CBE
 ms.author: chcomley
diff --git a/docs/integrate/get-started/authentication/azure-devops-oauth.md b/docs/integrate/get-started/authentication/azure-devops-oauth.md
@@ -8,7 +8,7 @@ monikerRange: 'azure-devops'
 ms.author: chcomley
 author: chcomley
 ms.date: 07/14/2025
-ms.custom: sfi-image-nochange
+ms.custom: sfi-image-nochange, pat-reduction
 ---
 
 # Use Azure DevOps OAuth 2.0
diff --git a/docs/integrate/get-started/authentication/entra-oauth.md b/docs/integrate/get-started/authentication/entra-oauth.md
@@ -3,6 +3,7 @@ title: Building Azure DevOps integrations with Microsoft Entra OAuth apps
 description: Use Microsoft Entra authentication to integrate with Azure DevOps Services.
 ms.assetid: 19285121-1805-4421-B7C4-63784C9A7CFA
 ms.subservice: azure-devops-security
+ms.custom: pat-reduction
 ms.topic: overview
 monikerRange: 'azure-devops'
 ms.author: chcomley
diff --git a/docs/integrate/get-started/authentication/entra.md b/docs/integrate/get-started/authentication/entra.md
@@ -16,10 +16,6 @@ ms.date: 02/24/2026
 
 [!INCLUDE [version-eq-azure-devops](../../../includes/version-eq-azure-devops.md)]
 
-> [!IMPORTANT]
-> Use Microsoft Entra ID authentication for new applications that integrate with Azure DevOps Services.
-> It provides enhanced security, enterprise identity integration, and modern authentication capabilities.
-
 [!INCLUDE [use-microsoft-entra-reduce-pats](../../../includes/use-microsoft-entra-reduce-pats.md)]
 
 This article explains the benefits of Microsoft Entra ID authentication and guides you through implementing it in your applications.
diff --git a/docs/integrate/get-started/authentication/oauth.md b/docs/integrate/get-started/authentication/oauth.md
@@ -4,6 +4,7 @@ title: OAuth 2.0 Authentication for Azure DevOps REST APIs
 description: Learn how to use OAuth 2.0 authentication with Azure DevOps REST APIs, with Microsoft Entra ID as the recommended approach.
 ms.assetid: 19285121-1805-4421-B7C4-63784C9A7CFA
 ai-usage: ai-assisted
+ms.custom: pat-reduction
 ms.subservice: azure-devops-security
 monikerRange: 'azure-devops'
 ms.author: chcomley
diff --git a/docs/integrate/index.md b/docs/integrate/index.md
@@ -5,6 +5,7 @@ title: Build secure applications and services with Azure DevOps
 description: Learn how to build secure, scalable applications that integrate with Azure DevOps using modern authentication and best practices.
 ms.assetid: c9b97ad7-ffd8-4657-8322-74f764eec5c9
 ai-usage: ai-assisted
+ms.custom: pat-reduction
 monikerRange: '<= azure-devops'
 ms.author: chcomley
 author: chcomley
diff --git a/docs/managed-devops-pools/prerequisites.md b/docs/managed-devops-pools/prerequisites.md
@@ -2,7 +2,7 @@
 title: Prerequisites for Managed DevOps Pools
 description: Learn how to configure your Azure subscription and Azure DevOps organization for use with Managed DevOps Pools.
 ms.date: 10/07/2025
-ms.custom: sfi-image-nochange
+ms.custom: sfi-image-nochange, pat-reduction
 ms.topic: concept-article
 ---
 
diff --git a/docs/organizations/accounts/faq-user-and-permissions-management.yml b/docs/organizations/accounts/faq-user-and-permissions-management.yml
@@ -20,6 +20,8 @@ summary: |
   [!INCLUDE [version-lt-eq-azure-devops](../../includes/version-lt-eq-azure-devops.md)]
   
    This article provides answers to frequently asked questions (FAQs) about user and permissions management in Azure DevOps. The FAQs are organized by topic to help you quickly find information about managing users, permissions, access levels, Visual Studio subscriptions, GitHub Enterprise integration, and related administrative tasks.
+
+  [!INCLUDE [use-microsoft-entra-reduce-pats](../../includes/use-microsoft-entra-reduce-pats.md)]
   <a name="general-permissions"></a>
   
 
diff --git a/docs/organizations/accounts/get-list-of-organizations-connected-to-microsoft-entra-id.md b/docs/organizations/accounts/get-list-of-organizations-connected-to-microsoft-entra-id.md
@@ -32,6 +32,8 @@ This list includes essential information such as:
 |**Organization** | Member of an Azure DevOps organization [connected to Microsoft Entra ID](connect-organization-to-azure-ad.md). |
 |**Azure DevOps CLI** | A Microsoft Entra token. For more information, see [Issue Microsoft Entra tokens with Azure CLI](../../cli/entra-tokens.md). |
 
+[!INCLUDE [use-microsoft-entra-reduce-pats](../../includes/use-microsoft-entra-reduce-pats.md)]
+
 ## Get list of organizations
 
 #### [Browser](#tab/browser)
diff --git a/docs/organizations/accounts/organization-management.md b/docs/organizations/accounts/organization-management.md
@@ -5,6 +5,7 @@ description: Manage an organization, so you can collaborate with others to devel
 ms.subservice: azure-devops-organizations
 ms.assetid: fa1dbe39-08b1-4eba-886a-33c1aa1e6a83
 ms.topic: overview
+ms.custom: pat-reduction
 ms.author: chcomley
 author: chcomley
 ms.date: 02/17/2026
diff --git a/docs/organizations/security/security-overview.md b/docs/organizations/security/security-overview.md
@@ -17,6 +17,10 @@ ms.date: 02/26/2026
 
 When you're handling information and data, especially in a cloud-based solution like Azure DevOps Services, security should be your top priority. While Microsoft ensures the security of the underlying cloud infrastructure, you're responsible for configuring security within Azure DevOps. This article provides an overview of necessary security-related configurations to protect your Azure DevOps environment against threats and vulnerabilities. 
 
+[!INCLUDE [ai-assistance-callout](../../includes/ai-assistance-callout.md)]
+
+[!INCLUDE [use-microsoft-entra-reduce-pats](../../includes/use-microsoft-entra-reduce-pats.md)]
+
 ## Protect your network and data
 
 Securing your network is crucial when you're working with Azure DevOps. Protect your data and resources from unauthorized access and potential threats. Implement network security and data protection measures to help ensure that only trusted sources can access your Azure DevOps environment. To secure your network when you're working with Azure DevOps, take the following actions:
@@ -46,7 +50,7 @@ Zero Trust helps protect against lateral movement within the network, ensuring t
 
 Ensure your Azure DevOps environment complies with industry standards and regulations that protect your environment and maintain trust with your users.
 
-- **Ensure compliance with industry standards:** Azure DevOps complies with various industry standards and regulations, such as ISO/IEC 27001, SOC 1/2/3, and GDPR. Ensure your environment adheres to these standards.
+- **Ensure compliance with industry standards:** Azure DevOps complies with various industry standards and regulations, such as ISO/IEC 27001, SOC 1/2/3, and more. Ensure your environment adheres to these standards.
 - **Enforce compliance policies:** Implement [branch policies](../../repos/git/branch-policies.md) and [compliance policies for your pipelines](/azure/governance/policy/tutorials/policy-devops-pipelines).
 - **Onboard to Component Governance for CI/CDs**, which offers the following benefits:
   - Security vulnerability detection: Alerts you to known vulnerabilities in open-source components.
diff --git a/docs/pipelines/agents/service-principal-agent-registration.md b/docs/pipelines/agents/service-principal-agent-registration.md
@@ -4,7 +4,7 @@ description: Learn how to register a self-hosted agent using a Service Principal
 ms.topic: concept-article
 ms.date: 04/26/2024
 monikerRange: 'azure-devops'
-ms.custom: arm2024, sfi-image-nochange
+ms.custom: arm2024, sfi-image-nochange, pat-reduction
 ---
 
 # Register an agent using a service principal
@@ -60,7 +60,7 @@ For more information about using Service Principal with Azure DevOps, see [Use s
 >
 > `ClientSecretCredential authentication failed: AADSTS90002: Tenant 'xxxxxxxxxxxxxx' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Check with your subscription administrator, this may happen if there are no active subscriptions for the tenant.`
 >
-> To resolve this error, set the login URL to Azure Public Cloud login by setting the environment variable `$AZURE_AUTHORITY_HOST` to 
+> To resolve this error, set the sign-in URL to Azure Public Cloud sign-in by setting the environment variable `$AZURE_AUTHORITY_HOST` to 
 `https://login.microsoftonline.com`, then run the agent config.cmd.
 > 
 > For more information, see [Azure in China developer guide](/azure/china/resources-developer-guide), 
diff --git a/docs/pipelines/security/overview.md b/docs/pipelines/security/overview.md
@@ -2,7 +2,7 @@
 title: Secure your Azure Pipelines
 description: Guidelines and recommendations for securing pipelines.
 ms.assetid: 1ef377e9-e684-4e72-8486-a42d754761ac
-ms.custom: peer-review-program
+ms.custom: peer-review-program, pat-reduction
 ms.date: 03/04/2025
 monikerRange: "<=azure-devops"
 ms.topic: best-practice
@@ -113,7 +113,7 @@ Learn how to secure containers through configuration changes, scanning, and poli
 - **Mark volumes as read only**: Containers include system-provided volume mounts for tasks, tools, and external components required to work with the host agent. Set `externals`, `tasks`, and `tools` to read only for added security. 
 - **Set container-specific resource limits**: Set limits on CPU and memory to prevent containers from consuming excessive resources, which can lead to denial of service or security vulnerabilities.
 - **Use trusted images**: Use official and verified images from reputable sources such as Azure Container Registry or Docker Hub. Always specify a specific version or tag to maintain consistency and reliability, rather than relying on the `latest` tag. Regularly update base images to include the latest security patches and bug fixes.
-- **Scan containers for vulnerabilities and enforce runtime threat protection**: Use tools such as [Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-containers-introduction) to monitor and detect security risks. Additionally, Azure Container Registry offers integrated [vulnerability scanning](/azure/container-registry/scan-images-defender) to help ensure container images are secure before deployment. You can also integrate third-party scanning tools through Azure DevOps extensions for added security checks.
+- **Scan containers for vulnerabilities and enforce runtime threat protection**: Use tools such as [Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-containers-introduction) to monitor and detect security risks. Additionally, Azure Container Registry offers integrated [vulnerability scanning](/azure/container-registry/scan-images-defender) to help ensure container images are secure before deployment. You can also integrate non-Microsoft scanning tools through Azure DevOps extensions for added security checks.
 - **Implement security policies to prevent privilege escalation and ensure containers run with the least amount of privileges necessary**: For example, Azure [Kubernetes Service (AKS)](/azure/aks/operator-best-practices-cluster-security), [role-based access control](/azure/aks/manage-azure-rbac), and [Pod Security Admission](/azure/aks/use-psa) let you enforce policies that restrict container privileges, ensure non-root execution, and limit access to critical resources. 
 - **Utilize Network Policies**: [Network Policies](/azure/virtual-network/kubernetes-network-policies) can be used to restrict communication between containers, ensuring that only authorized containers can access sensitive resources within your network. In addition, [Azure Policy for AKS](/azure/governance/policy/concepts/policy-for-kubernetes) can be applied to enforce container security best practices, such as ensuring only trusted container images are deployed.
 
diff --git a/docs/pipelines/security/secrets.md b/docs/pipelines/security/secrets.md
@@ -3,6 +3,7 @@ title: Secrets in pipelines
 description: Learn about best practices for protecting secrets in Azure Pipelines.
 ms.date: 09/10/2025
 monikerRange: "<=azure-devops"
+ms.custom: pat-reduction
 #customer intent: As an Azure Pipelines user, I want to understand best practices for using secrets in Azure Pipelines so I can limit and control access to secrets in pipelines.
 
 ms.topic: best-practice
diff --git a/docs/report/powerbi/client-authentication-options.md b/docs/report/powerbi/client-authentication-options.md
@@ -17,21 +17,9 @@ ms.custom: sfi-image-nochange, pat-reduction
 
 [!INCLUDE [version-lt-eq-azure-devops](../../includes/version-lt-eq-azure-devops.md)]
 
-[!INCLUDE [use-microsoft-entra-reduce-pats](../../includes/use-microsoft-entra-reduce-pats.md)]
-
-::: moniker range="azure-devops"
-
-When you connect from Power BI or Excel to Analytics by using the OData feed, choose **Microsoft Entra ID** for the most secure option.
-You can also authenticate with personal access tokens (PATs), but this method is less secure.
-
-::: moniker-end
+When you connect to [Analytics](../powerbi/what-is-analytics.md) from Power BI or Excel, you must authenticate to Azure DevOps. This article explains how to enter credentials, choose an authentication method, and update stored credentials when they expire or need to change.
 
-::: moniker range="<azure-devops"
-
-When you connect from Power BI or Excel to Analytics by using the OData feed, choose Windows credentials as the most secure option.
-You can also authenticate with personal access tokens (**PATs**), but this method is less secure.
-
-::: moniker-end
+[!INCLUDE [use-microsoft-entra-reduce-pats](../../includes/use-microsoft-entra-reduce-pats.md)]
 
 ## Prerequisites
 
diff --git a/docs/report/secure-your-analytics-reporting.md b/docs/report/secure-your-analytics-reporting.md
@@ -3,7 +3,7 @@ title: Secure your analytics & reporting
 titleSuffix: Azure DevOps
 description: Learn about security concepts, access controls, and best practices for protecting your analytics data and reports in Azure DevOps.
 ms.subservice: azure-devops-security
-ms.custom: horz-security
+ms.custom: horz-security, pat-reduction
 ms.author: chcomley
 author: chcomley
 ms.topic: overview
diff --git a/docs/repos/git/create-pr-status-server-with-azure-functions.md b/docs/repos/git/create-pr-status-server-with-azure-functions.md
@@ -28,6 +28,8 @@ For more information about PR status, see [Customize and extend pull request wor
 | **Service Hooks** | [Configure service hooks](#configure-a-service-hook-for-pr-events) for PR events to notify your Azure function when a pull request changes. |
 | **Authentication** | **Microsoft Entra ID token** with the **Code (status)** scope to have permission to change PR status. For more information, see [Microsoft Entra authentication](../../integrate/get-started/authentication/entra.md). |
 
+[!INCLUDE [use-microsoft-entra-reduce-pats](../../includes/use-microsoft-entra-reduce-pats.md)]
+
 ### Create a basic Azure Function to listen to Azure Repos events
 
 [Create your first Azure function](/azure/azure-functions/functions-create-first-azure-function). Then, modify the code in the sample to look like the following code:
diff --git a/docs/repos/git/create-pr-status-server.md b/docs/repos/git/create-pr-status-server.md
@@ -8,7 +8,7 @@ ms.topic: tutorial
 ms.date: 02/24/2026
 monikerRange: '<= azure-devops'
 ms.subservice: azure-devops-repos-git
-ms.custom: devx-track-js, sfi-image-nochange
+ms.custom: devx-track-js, sfi-image-nochange, pat-reduction
 ai-usage: ai-assisted
 # customer-intent: As a developer, I want to create a Node.js server that integrates with Azure DevOps pull request events so I can implement custom status checks and automated validation workflows using Microsoft Entra ID authentication.
 ---
diff --git a/docs/service-hooks/authorize.md b/docs/service-hooks/authorize.md
@@ -1,9 +1,9 @@
 ---
+title: Manage Service Authorizations in Azure DevOps
+description: Learn how to use OpenID Connect (OIDC)-based authentication to securely grant services access to your Azure DevOps resources without sharing your credentials.
 ms.subservice: azure-devops-service-hooks
 ms.topic: how-to
-title: Authorize Services 
-ms.custom: engagement-fy23
-description: Find out how to use OpenID Connect (OIDC)-based authentication to grant a service access to your Azure DevOps work items, source code, and other resources.
+ms.custom: engagement-fy23, pat-reduction
 ms.assetid: 314a28cd-b2ae-41a0-8dfb-330222c1aed0
 ms.author: chcomley
 author: chcomley
diff --git a/docs/service-hooks/consumers.md b/docs/service-hooks/consumers.md
@@ -1,7 +1,7 @@
 ---
 title: Service Hook Consumers
 description: Find information about Azure DevOps service hook consumers, including settings to use when you create subscriptions in Azure DevOps and configure consumers.
-ms.custom: engagement-fy23, devx-track-jenkins
+ms.custom: engagement-fy23, devx-track-jenkins, pat-reduction
 ms.assetid: CDACB8A1-4BAB-499F-B9ED-BD1680743B26
 ms.subservice: azure-devops-service-hooks
 ms.topic: overview
diff --git a/docs/service-hooks/create-subscription.md b/docs/service-hooks/create-subscription.md
@@ -2,7 +2,7 @@
 title: Create a Service Hook Subscription Programmatically
 description: Find out how to programmatically create a service hook subscription that prescribes an action to take when a specified event occurs in Azure DevOps.
 ms.assetid: 0614F217-4F4E-45DC-A50C-B9FF81F8A5BD
-ms.custom: engagement-fy23
+ms.custom: engagement-fy23, pat-reduction
 ms.subservice: azure-devops-service-hooks
 ms.topic: how-to
 ms.author: chcomley
diff --git a/docs/user-guide/troubleshoot-connection.md b/docs/user-guide/troubleshoot-connection.md
@@ -4,7 +4,7 @@ titleSuffix: Azure DevOps
 description: Learn how to resolve common connection problems, authentication errors, and permission issues when you access projects and organizations.
 ms.subservice: azure-devops-new-user
 ai-usage: ai-assisted
-ms.custom: copilot-scenario-highlight
+ms.custom: copilot-scenario-highlight, pat-reduction
 ms.author: chcomley
 author: chcomley
 ms.topic: troubleshooting
