Why authenticating with AD access token is failing for the Azure DevOps REST APIs for managing PATs

Viewed 52

I'm trying to build a pipeline to automate the Azure PAT renewal process.

According to what I found I can only use PAT Lifecycle Management APIs to manage PATs programmatically. https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-personal-access-tokens-via-api?view=azure-devops

To use this API, must authenticate with an Azure AD token. To get an Azure AD token, created an app in the Azure Active directory & gave API permissions as Azure DevOps -> delegated permissions -> user_impersonation

Used the following code to generate an access token

$connectionDetails = @{

    'TenantId'     = '$tenant_id'
    'ClientId'     = 'client_id'
    'ClientSecret' = 'client_secret' | ConvertTo-SecureString -AsPlainText -Force
}
$token = Get-MsalToken @connectionDetails

Used the following code to fetch PATs

$authHeader = @{
    'Authorization' = $token.CreateAuthorizationHeader()
}

Invoke-RestMethod -H $authHeader "https://vssps.dev.azure.com/$organization/_apis/Tokens/Pats?api-version=6.1-preview"

The Token was generated successfully. But when using that token as a bearer token to the REST API, returns the Azure DevOps sign-in page

Why authenticating with the AD access token is failing for the Azure DevOps REST APIs for managing the PATs. Are there any other options to automate PAT renewal process?

0 Answers
Related