GitHub Actions removals · checked

Azure DevOps global PATs stop working 1 Dec 2026: vsce publish without a PAT

Azure DevOps global personal access tokens: stop working 1 Dec 2026, in 40 days. Breaks on 1 Dec 2026 if the token is a global PAT: Microsoft decommissions every global PAT that day, and the VS Code Marketplace authenticates through Azure DevOps, so vsce publish (or tfx extension publish) with one fails. Microsoft's post retires the global type only; it does not say a PAT scoped to one organization stops, so check each token's scope. Azure DevOps Server is unchanged. The fix: Publish with Microsoft Entra ID instead of a PAT: sign in with azure/login over OIDC (a managed identity with a federated credential for the workflow), then run vsce publish --azure-credential. Find every place your workflows use it: npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz

$ npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz

npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz reads .github/workflows in the current directory (or owner/repo through GitHub's API with your own token) and lists every runner label, action version, runtime, workflow command and trigger a dated GitHub removal hits, with the file, the line and the fix. No account; nothing about your workflows is sent to us. Its requests fetch this data and the public action.yml of the actions you use. Free and MIT licensed.

The facts

What
Azure DevOps global personal access tokens
Matches
Steps that run vsce publish -p|--pat, tfx extension publish -t|--token, tfx-cli extension publish -t|--token, or an env named VSCE_PAT, AZURE_DEVOPS_EXT_PAT, AZURE_DEVOPS_TOKEN
Effect
Breaks a job
Announced
12 December 2025
Date
1 Dec 2026stop working 1 Dec 2026, in 40 days
After the date
Breaks on 1 Dec 2026 if the token is a global PAT: Microsoft decommissions every global PAT that day, and the VS Code Marketplace authenticates through Azure DevOps, so vsce publish (or tfx extension publish) with one fails. Microsoft's post retires the global type only; it does not say a PAT scoped to one organization stops, so check each token's scope. Azure DevOps Server is unchanged.
The fix
Publish with Microsoft Entra ID instead of a PAT: sign in with azure/login over OIDC (a managed identity with a federated credential for the workflow), then run vsce publish --azure-credential.
Replace
vsce publish -p → vsce publish --azure-credentialvsce publish --pat → vsce publish --azure-credentialVSCE_PAT → azure/login (OIDC), then vsce publish --azure-credential

Is your token global?

In Azure DevOps, open User settings, then Personal access tokens, and set Access scope to All accessible organizations with Status Active: every token listed is a global PAT. A token is global when its Organization field reads All accessible organizations. VS Code's own steps for a Marketplace token choose All accessible organizations, and its FAQ names choosing one organization as a cause of 401 and 403 errors from vsce publish.

The fix as a workflow, with no token to store

# .github/workflows/publish.yml: publish to the VS Code Marketplace with no PAT.
# Once: a user-assigned managed identity in Azure with a federated credential for this
# repository's "marketplace" environment, added to your Marketplace publisher as a
# Contributor (VS Code's publishing docs show how to find its ID); AZURE_CLIENT_ID,
# AZURE_TENANT_ID and AZURE_SUBSCRIPTION_ID set as repository variables.
on:
  release:
    types: [published]
permissions:
  contents: read
  id-token: write
jobs:
  publish:
    runs-on: ubuntu-24.04
    environment: marketplace
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
      - run: npm ci
      - uses: azure/login@v3
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - run: npm install -g @vscode/vsce
      - run: vsce publish --azure-credential

Check by hand

From the repository root; the command above also reads matrices, inputs to reusable workflows and each action's own action.yml, which a grep cannot.

$ grep -rnE "vsce publish.* (-p|--pat)[ =]|tfx extension publish.* (-t|--token)[ =]|tfx-cli extension publish.* (-t|--token)[ =]|VSCE_PAT|AZURE_DEVOPS_EXT_PAT|AZURE_DEVOPS_TOKEN" .github

In CI, before the next date

The same check as a GitHub Action. It annotates each workflow line it finds: a warning 60 days ahead, an error 14 days before a brownout or removal (or once it is in effect), and the job fails on an error. Warning-only findings never fail it. The weekly run turns the check red as a date comes closer, even when nothing changed.

# .github/workflows/actions-eol.yml
on:
  pull_request:
    paths: [".github/**", "action.yml", "action.yaml"]
  schedule:
    - cron: "17 7 * * 1"
permissions:
  contents: read
jobs:
  actions-eol:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - uses: agentwares/actions-eol@main
        with:
          warn-days: 60
          fail-days: 14

Notes

  • Microsoft first said creating or regenerating global PATs would be blocked from 15 Mar 2026. An update to its post, dated 03/05, dropped that block: global PATs can still be created until 1 Dec 2026.
  • tfx extension publish takes its PAT with --token (-t); neither Microsoft page, read on 19 Oct 2026, names an Entra ID replacement for it.

Sources

An email before each brownout, for the repos you watch, is not built.

It would re-read your workflows every day and email you a week and a day before each brownout or removal that would hit them, with no change to your repo. agentcheck's free hourly watch covers MCP servers only today. If you would pay for this one, say so with one click. The click is counted, and nothing else is sent or stored unless you then leave an email.

Other GitHub Actions removals

Every removal, by date

actions-eol is a free tool from agentcheck, which runs scheduled checks of your endpoints and alerts you when an answer changes. Dates come from Microsoft's own pages, read on the day shown; Azure DevOps Services only, since Azure DevOps Server keeps its global PATs.