I'm trying to build a pipeline to automate the Azure PAT renewal process.
According to what I found I can only use PAT Lifecycle Management APIs to manage PATs programmatically. https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-personal-access-tokens-via-api?view=azure-devops
To use this API, must authenticate with an Azure AD token. To get an Azure AD token, created an app in the Azure Active directory & gave API permissions as Azure DevOps -> delegated permissions -> user_impersonation
Used the following code to generate an access token
$connectionDetails = @{
'TenantId' = '$tenant_id'
'ClientId' = 'client_id'
'ClientSecret' = 'client_secret' | ConvertTo-SecureString -AsPlainText -Force
}
$token = Get-MsalToken @connectionDetails
Used the following code to fetch PATs
$authHeader = @{
'Authorization' = $token.CreateAuthorizationHeader()
}
Invoke-RestMethod -H $authHeader "https://vssps.dev.azure.com/$organization/_apis/Tokens/Pats?api-version=6.1-preview"
The Token was generated successfully. But when using that token as a bearer token to the REST API, returns the Azure DevOps sign-in page
Why authenticating with the AD access token is failing for the Azure DevOps REST APIs for managing the PATs. Are there any other options to automate PAT renewal process?