> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/azure-devops/identities-and-pats.md).
# Identities & PATs
The Identities & PATs page gives security and platform teams a single inventory of everything that holds access to your Azure DevOps organization: Personal Access Tokens, service connections, and Entra service principals.
**To reach this page:** open the sidebar and select **Identities & PATs**.
The page has three tabs:
* **Personal Access Tokens**: every PAT across the organization, with its scopes, lifetime, and activity
* **Service Connections**: the service connections pipelines use to reach external systems
* **Service Principals**: Entra service principals and managed identities added to the organization
#### Why this inventory matters
Personal Access Tokens, service connections, and service principals are what power pipelines, automation, and third-party integrations. Over time, organizations accumulate:
* Tokens with broader scopes than the work requires
* Tokens that are long-lived, unused, or rarely reviewed
* Access still owned by people who have changed roles or left
The PAT Governance controls on the [Overview](/azure-devops/overview.md) page evaluate this inventory automatically. This page is where you go to inspect it directly, filter it, and export it.
#### Refreshing the data
StepSecurity builds this inventory by calling the Azure DevOps APIs for your organization. It refreshes automatically once every hour, so a token, service connection, or service principal added or removed in Azure DevOps appears here within the hour.
The **Last refreshed** timestamp at the top of the page shows when the current data was collected, in UTC.
Select **Refresh** in the top right to collect the data again immediately rather than waiting for the next hourly refresh. This re-reads tokens, service connections, and service principals, then updates the page with the latest state. Use it after making a change in Azure DevOps that you want reflected straight away, such as revoking a token or adding a service principal.
{% hint style="info" %}
Because the inventory is read from Azure DevOps rather than held by StepSecurity, anything Azure DevOps does not expose through its APIs will not appear here. A token's secret value is never retrieved.
{% endhint %}
### Personal Access Tokens
This tab lists Personal Access Tokens across your Azure DevOps organization.
#### Filters
| Filter | Behavior |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| **Search tokens** | Free-text match on token name |
| **Owner** | Narrow to one or more token owners |
| **Scopes** | Narrow to tokens holding specific scopes |
| **Scope risk** | Narrow to high privilege or standard tokens |
| **Scope: All** | Narrow by the token's access scope |
| **Policy: All** | Narrow to tokens violating a specific PAT Governance control |
| **Hide expired or revoked** | On by default, so the table shows only tokens that are still live. Clear it to include expired and revoked tokens |
#### Columns
| Column | Meaning |
| -------------------- | ------------------------------------------------------------------------------------------------------ |
| **Owner** | Display name of the token owner, with the Azure DevOps owner ID beneath it |
| **Token name** | Token name as set in Azure DevOps |
| **Token ID** | Identifier for the token, used to correlate with Azure DevOps audit records |
| **Scopes** | Scopes granted to the token, shown as chips. A **+N more** link expands scopes that do not fit the row |
| **Created on (GMT)** | When the token was created |
| **Expires on (GMT)** | When the token expires |
| **Last Active** | The most recent activity recorded for the token |
Select the chevron at the start of a row to expand it and see the token's full detail.
{% hint style="info" %}
Scope chips are color coded by risk. Scopes Microsoft rates high privilege, such as `vso.agentpools_manage`, `vso.security_manage`, and `vso.tokenadministration`, appear in red. Standard scopes such as `vso.build` and `vso.project` appear in gray. This lets you spot over-privileged tokens without reading every scope.
{% endhint %}
### Service Connections
This tab lists the service connections configured across your Azure DevOps organization.
#### Filters
| Filter | Behavior |
| ----------------------------- | -------------------------------------------------------------------------------------------------- |
| **Search service connection** | Free-text match on connection name |
| **Type** | Narrow by the external system the connection targets, for example GitHub or Azure Resource Manager |
| **Owner** | Narrow by the identity that owns the connection |
| **OIDC: All** | Narrow to connections that use OIDC federation, or those that do not |
| **Status: All** | Narrow by connection status |
#### Columns
| Column | Meaning |
| --------------- | ----------------------------------------------------------------- |
| **Name** | Service connection name as set in Azure DevOps |
| **Type** | The external system the connection targets |
| **Auth scheme** | How the connection authenticates, for example `InstallationToken` |
| **Created by** | The identity that created the connection |
| **Ready** | Whether the connection is currently usable by pipelines |
| **View** | Opens the service connection in Azure DevOps |
Select the chevron at the start of a row to expand it and see the connection's full detail.
{% hint style="info" %}
Prefer service connections that authenticate with OIDC federation over ones that store a long-lived secret. Use the **OIDC** filter to find connections that still rely on a stored credential.
{% endhint %}
### Service Principals
This tab lists Entra service principals and managed identities added to your Azure DevOps organization.
#### Filters
| Filter | Behavior |
| ----------------------------- | ----------------------------------------- |
| **Search service principals** | Free-text match on service principal name |
| **Status: All** | Narrow by service principal status |
#### Columns
| Column | Meaning |
| ------------------ | ------------------------------------------------------------ |
| **Name** | Service principal display name. Opens the identity in Azure |
| **Application ID** | The Entra application ID |
| **Kind** | Identity type, for example `servicePrincipal` |
| **Status** | Whether the identity is currently active in the organization |
Select the chevron at the start of a row to expand it and see the service principal's full detail.
Service principals are the recommended home for automation that would otherwise run on a Personal Access Token owned by a person. The **Remediation** guidance on several PAT Governance controls points here for that reason.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/azure-devops/identities-and-pats.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
