Identities & PATs

The Identities & PATs page gives security and platform teams a single inventory of everything that holds access to your Azure DevOps organization: Personal Access Tokens, service connections, and Entra service principals.

To reach this page: open the sidebar and select Identities & PATs.

The page has three tabs:

• Personal Access Tokens: every PAT across the organization, with its scopes, lifetime, and activity
• Service Connections: the service connections pipelines use to reach external systems
• Service Principals: Entra service principals and managed identities added to the organization

Why this inventory matters

Personal Access Tokens, service connections, and service principals are what power pipelines, automation, and third-party integrations. Over time, organizations accumulate:

• Tokens with broader scopes than the work requires
• Tokens that are long-lived, unused, or rarely reviewed
• Access still owned by people who have changed roles or left

The PAT Governance controls on the Overview page evaluate this inventory automatically. This page is where you go to inspect it directly, filter it, and export it.

Refreshing the data

StepSecurity builds this inventory by calling the Azure DevOps APIs for your organization. It refreshes automatically once every hour, so a token, service connection, or service principal added or removed in Azure DevOps appears here within the hour.

The Last refreshed timestamp at the top of the page shows when the current data was collected, in UTC.

Select Refresh in the top right to collect the data again immediately rather than waiting for the next hourly refresh. This re-reads tokens, service connections, and service principals, then updates the page with the latest state. Use it after making a change in Azure DevOps that you want reflected straight away, such as revoking a token or adding a service principal.

Because the inventory is read from Azure DevOps rather than held by StepSecurity, anything Azure DevOps does not expose through its APIs will not appear here. A token's secret value is never retrieved.

Personal Access Tokens

This tab lists Personal Access Tokens across your Azure DevOps organization.

Filters

Filter	Behavior
Search tokens	Free-text match on token name
Owner	Narrow to one or more token owners
Scopes	Narrow to tokens holding specific scopes
Scope risk	Narrow to high privilege or standard tokens
Scope: All	Narrow by the token's access scope
Policy: All	Narrow to tokens violating a specific PAT Governance control
Hide expired or revoked	On by default, so the table shows only tokens that are still live. Clear it to include expired and revoked tokens

Columns

Column	Meaning
Owner	Display name of the token owner, with the Azure DevOps owner ID beneath it
Token name	Token name as set in Azure DevOps
Token ID	Identifier for the token, used to correlate with Azure DevOps audit records
Scopes	Scopes granted to the token, shown as chips. A +N more link expands scopes that do not fit the row
Created on (GMT)	When the token was created
Expires on (GMT)	When the token expires
Last Active	The most recent activity recorded for the token

Select the chevron at the start of a row to expand it and see the token's full detail.

Scope chips are color coded by risk. Scopes Microsoft rates high privilege, such as vso.agentpools_manage, vso.security_manage, and vso.tokenadministration, appear in red. Standard scopes such as vso.build and vso.project appear in gray. This lets you spot over-privileged tokens without reading every scope.

Service Connections

This tab lists the service connections configured across your Azure DevOps organization.

Filters

Filter	Behavior
Search service connection	Free-text match on connection name
Type	Narrow by the external system the connection targets, for example GitHub or Azure Resource Manager
Owner	Narrow by the identity that owns the connection
OIDC: All	Narrow to connections that use OIDC federation, or those that do not
Status: All	Narrow by connection status

Columns

Column	Meaning
Name	Service connection name as set in Azure DevOps
Type	The external system the connection targets
Auth scheme	How the connection authenticates, for example InstallationToken
Created by	The identity that created the connection
Ready	Whether the connection is currently usable by pipelines
View	Opens the service connection in Azure DevOps

Select the chevron at the start of a row to expand it and see the connection's full detail.

Prefer service connections that authenticate with OIDC federation over ones that store a long-lived secret. Use the OIDC filter to find connections that still rely on a stored credential.

Service Principals

This tab lists Entra service principals and managed identities added to your Azure DevOps organization.

Filters

Filter	Behavior
Search service principals	Free-text match on service principal name
Status: All	Narrow by service principal status

Columns

Column	Meaning
Name	Service principal display name. Opens the identity in Azure
Application ID	The Entra application ID
Kind	Identity type, for example servicePrincipal
Status	Whether the identity is currently active in the organization

Select the chevron at the start of a row to expand it and see the service principal's full detail.

Service principals are the recommended home for automation that would otherwise run on a Personal Access Token owned by a person. The Remediation guidance on several PAT Governance controls points here for that reason.