Solved: How to create Personal Access Token (PAT) for Service Accounts?

Troubleshooting Question

We’ve been encountering issues when using Personal Access Tokens (PATs) associated with regular user accounts. When these tokens expire or when a user is unavailable or leaves the company, it disrupts the functionality of resources reliant on these PATs.

In our organization, we typically have two types of accounts:

• User Accounts: These are the accounts used by regular employees to log in to their office laptops. When an employee leaves the company, their account is deactivated.
• Service Accounts: These accounts serve a different purpose. They are used in technical contexts, especially for making service-to-service calls. Unlike user accounts, service account passwords can be shared among teams, and these accounts aren’t tied to individual employees. They exist within the Active Directory (AD) but aren’t associated with actual human users.

We’ve successfully created service accounts within our organization’s Active Directory, and these accounts are also synchronized with Azure Active Directory. Now, the question is, how do we generate a Personal Access Token (PAT) for these service accounts? We want to ensure a stable and reliable authentication mechanism for our technical processes without depending on individual user accounts.

Could you please provide guidance on creating and managing PATs for service accounts within this context?

Solution: Generating a Personal Access Token (PAT) for a Service Account

A service account functions similarly to a regular user account in many ways, including the concept of not needing to rotate credentials frequently. To generate a Personal Access Token (PAT) for a service account, you can follow these steps:

Step 1: Log in to Azure DevOps using the service account credentials.

Step 2: Once logged in, you can navigate to the PAT generation section within DevOps.

Step 3: Generate a PAT for the service account.

By following these steps, you’ll be able to create a PAT that can be used with the service account to authenticate and access resources within Azure DevOps. This approach allows you to maintain stability and reliability in your technical processes without relying on individual user accounts.