Azure DevOps will no longer support Alternate Credentials authentication

Avatar

We, the Azure DevOps team, work hard to ensure that your code is protected while enabling you to have friction free access. Until now, we’ve offered customers the ability to use Alternate Credentials in situations where they are connecting to Azure DevOps using legacy tools. While using Alternate Credentials was an easy way to set up authentication access to Azure DevOps, it is also less secure than other alternatives such as personal access tokens (PATs). As such, we believe the use of Alternate Credentials authentication represents a security risk to our customers because they never expire and can’t be scoped to limit access to the Azure DevOps data.

Security Changes

Azure DevOps will stop supporting Alternate Credentials authentication beginning March 2, 2020. The deprecation process will start by disabling and hiding this feature for organizations that are not using Alternate Credentials beginning December 9, 2019. Then starting March 2, 2020 we will gradually turn off this feature for the rest of the organizations, which means that individuals using Alternate Credentials have until then to transition to a more secure authentication method to avoid this breaking change impacting their DevOps workflows.

Will this impact you?

For each organization you belong to, in order to check if you have Alternate Credentials configured, go to the Azure DevOps portal. In the top right corner, open the User Settings menu User settings icon, then click on the Alternate Credentials menu item.

User settings menu

If you have Alternate Credentials configured in Azure DevOps, you will see it listed. In this case, you should move to another form of authentication by March 2, 2020. We recommend PATs. If you are using Alternate Credentials with Git (this is the most common usage scenario), then follow these instructions to set up Git with PATs. The recommendation for Linux is to use SSH keys.
If you see ‘Secondary Inactive’ or a message stating that Alternate Credentials were disabled for your organization, it means you don’t have Alternate Credentials set in Azure DevOps. There is no action item for you.

Deprecation Timeline

  • Beginning December 9, 2019 we will disable and hide Alternate Credentials settings for organizations that don’t have Alternate Credentials set. This change will be in effect for all these organizations by December 20, 2019.
  • In the coming months we will work with our customers that are still using the feature, to help them switch to another, more secure authentication method.
  • March 2, 2020 – Start gradually disabling Alternate Credentials for all Azure DevOps organizations.

Contact Us

If you have any questions, please open a developer community item with the tag [AltCreds] in the title. For faster service, please search for [AltCreds] in the developer community forum first, as your question might already be answered. You can reach out to us on Twitter at @AzureDevOps too.

FAQ

Q: As a user, what happens when Azure DevOps disables Alternate Credentials?
A: The tools that you use to connect to Azure DevOps using Alternate Credentials will stop working.

Q: As a user, how do I know in what scenario I am using Alternate Credentials in a specific organization?
A: We will email you the user agent (if we have it) and the identity that is using it, starting mid-December 2019.

Q: As a user, should I delete my Alternate Credentials for a specific organization?
A: You are not required to, but this is a way to test if anything is broken if you remove them. You can re-enable your Alternate Credentials after completing the test. Save the username and password somewhere before deleting it, just in case.

Q: As an administrator, how do I know if there are active users of Alternate Credentials in my organization?
A: We will email you this information, along with the user agents (if we have this information) and the identities that are using Alternate Credentials, starting mid-December 2019.

Q: As an administrator, should I turn off the alternate Credentials policy?
A: If you want to get this change faster, you can turn the policy off. Turning the policy off is reversible until December 8, 2019. After that, you won’t be able to turn the policy on from the portal. You would need to contact us to do that. (contact info above).

Q: Will this change apply to Azure DevOps Server?
A: No, because we already do not support Alternate Credentials in Azure DevOps Server.

Avatar
Corina Arama

Senior Program Manager, Azure DevOps

Follow    

5 comments

  • Avatar
    hgalm_prenom hgalm_nom

    Will this change apply to Azure DevOps Server?
    A: No, because we already do not support Alternate Credentials in Azure DevOps Server.

    Hi,
    In fact that’s not completely true. Alt IS supported when configuring build agents against a Devops Server (see https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-windows?view=azure-devops#required-options). There are currently some issues on *nix platform using only PAT (see https://github.com/microsoft/azure-pipelines-agent/issues/2565#issuecomment-555448786), and sometimes Alt is the only “out-of-the-box” working auth mecanism that works on these platforms. You should clarify support/roadmap about the Alt /Basic support into Devops Server.
    Regards,

  • Avatar
    Daniel Schroeder

    I’m all for having more secure authentication methods and think this is a step in the right direction. 👍

    You also mentioned “while enabling you to have friction free access”. For this change to truly cause less friction, please prioritize this feature request to allow Personal Access Tokens not to expire (https://developercommunity.visualstudio.com/idea/817953/allow-personal-access-tokens-that-do-not-expire.html). Having to track down everywhere a PAT is used and replace it every year is definitely not a “friction free” experience.

    Thanks for the update Corina 🙂

  • Avatar
    Andrew Stanton

    Can we expect this same level of care and ceremony when build agent platforms get upgraded or when retention settings handling is changed?

    The lack of announcements on these kinds of things is far more interrupitve and destructive than a credential system change that is surely less used than build agents and retention settings. That lack of announcement for those creates unexpected “drop what you are working on” level of work interruptions, and they dont get a blog post or any info tips in the UI leading up to it.

    If you want to notify people, a blog post is not really the way. This should be either a persistent popup to those who use the feature, or a notification to the affected org admins, or both.

    • Avatar
      Corina Arama

      Hi Andrew, I forwarded your message to the Build team. Thank you for sharing your suggestions. Our goal is to make these changes with minimal disruption. In addition to the blog, we are notifying our customers of the Alternate Credentials change by:
      – Adding a note to the relevant documentation pages like this one: https://docs.microsoft.com/en-us/azure/devops/repos/git/auth-overview?view=azure-devops
      – Displaying banners in the User Settings -> Alternate Credentials and Policy Settings pages. This will roll out to customers by January 2020
      – Email campaigns that will start mid December 2019 (please see FAQ above)

Leave a comment