Support publishing extensions with organization-scoped PATs due to global PATs being retired

[DanTup]

I had an email today from Microsoft:

Action required: Azure DevOps global PATs are retiring

Global PATs allow a single token to access all Azure DevOps organizations you belong to. To reduce risk from broadly scoped credentials and support regional data requirements, this token type is being retired.

You’re receiving this email because one or more global personal access token(s) associated with your account was used in 1 organization(s) in the last 30 days.

The only global PAT I know of is the one used to publish extensions. I believe it's currently a requirement for this to be global, and the docs at https://code.visualstudio.com/api/working-with-extensions/publishing-extension do say to make it global:

In the Create a new personal access token modal, select the following details for the token:
Organization: All accessible organizations

So this is a request to support organization-specific tokens before December 1st 2026. If it's already supported (I haven't tested it recently), then just the docs need updating.

[DanTup]

Benjamin Christopher Simmonds (@benibenj) do you know if there are any plans to support this before the deadline? Or if not, will there be clear migration docs for Entra ID–based authentication (particularly for those of us using GitHub and not Azure)?

[microsoft-github-policy-service]

Team, please add a Type:Bug/Type:Feature/Type:CustomerSupport label as applicable.

[madhurivadaligithub]

Thank you for reaching out, could you please contact us via the VS Marketplace Support alias (VSMarketplace@microsoft.com) so we can assist you promptly on this.

Regards,
VS Marketplace Team

[DanTup]

madhurivadaligithub I've sent an email, however I suspect there are many extension authors with the same question and concerns as me, so I think some public information on the plans would be helpful for all. If there are no plans to support org-scoped PATs and we must move to some other mechanism, a guide (and/or an official GitHub action) would be helpful (and the sooner the better, because it may take time for extension authors to migrate).

[JeremyVyska]

Mads Kristensen (@madskristensen) This is what I messaged you about in LinkedIn

[DanTup]

FWIW for others following, I emailed the address given above but the response was only a link to https://code.visualstudio.com/api/working-with-extensions/publishing-extension#secure-automated-publishing-to-visual-studio-marketplace

To which I responded with some questions:

1. Do you plan to support organization-scoped PATs before the end of the year? Or is Entra ID-based auth the only option?
2. Do you plan to provide a guide for those using GitHub to publish? The instructions in the page you linked appear to be for Azure Pipelines, but everything is on GitHub. I don't want to maintain two systems for building/testing the extension.
3. Does this change completely prevent publishing from a local machine?

My feeling is that there are a lot of VS Code extensions authors that will find this too complex - I've already seen complaints about the existing PAT setup being too complicated.

[flying-sheep]

Seems like soon(!) vsce can just use Trusted Publishing to publish from GitHub actions! https://github.com/microsoft/vscode-vsce#trusted-publishing

/edit: which is an even simpler way of doing this that doesn’t involve a token at all.