---
id: "azure_devops_pat"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["secrets"]
langs: ["common"]
quality: 75
url: "https://registry.apicrafter.io/datatype/azure_devops_pat"
---

# Azure DevOps personal access token (`azure_devops_pat`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Personal access token of Azure DevOps, used instead of a password for Git, the REST API and package feeds. Tokens in the current format have 84 letters and digits with the marker JQQJ99 after the first 52 characters and the signature AZDO at positions 77 to 80. Older 52-character tokens are not covered. The regexp follows the pattern of the Microsoft security-utilities library; Microsoft Purview describes the same key.

- Parent datatype: `access_token`
- Personal data (PII): no
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^[A-Za-z0-9]{52}JQQJ99[A-Za-z0-9][A-L][A-Za-z0-9]{12}AAAAAZDO[A-Za-z0-9]{4}$
```

## Mappings

- purview: `Azure DevOps personal access token`

## Supported by tools

- `datadogsds`
- `gitguardian`
- `githubsecretscanning`
- `microsoftpurview`

## Sources

- doc: <https://learn.microsoft.com/en-us/purview/sit-defn-azure-devops-personal-access-token>
- other: <https://github.com/microsoft/security-utilities/blob/main/GeneratedRegexPatterns/PreciselyClassifiedSecurityKeys.json>

## Quality

Score 75/100. Missing: examples, negative example, translation.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/azure_devops_pat.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/azure_devops_pat.yaml>