Build Features - using parameter for PAT authentication.
Using both the Pull Requests and Commit Status publisher build features in TeamCity Enterprise 2026.2.1 Build 239120
We use PAT to talk with TFS, however there is forced PAT expiry dates. We have tried putting the PAT in a root level parameter than all plans use, and update that once in a central place, however this doesn't work, when the variable %myPAT% is pasted into either of these build features, the value is stored, not the reference. This means when the PAT changes, lots of plans need manually updating.
Surely there is a better way? Is this a bug?
Please sign in to leave a comment.
I tested this locally on TeamCity 2026.2.1 by copying %myPAT% directly into the PAT fields of both the Pull Requests and Commit Status Publisher build features. I could not reproduce the behavior you described: the parameter reference was retained rather than replaced with its value. You can also use Test Connection to check authentication after entering the reference.
As an alternative to manually rotating PATs, Microsoft recommends (https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops) using Microsoft Entra tokens, managed identities, or service principals for applications and automation whenever possible.
If you use Azure DevOps Services (cloud), I recommend configuring an Azure DevOps OAuth 2.0 connection and using Refreshable access token authentication in both build features:
1. Go to Root project → Connections → Add Connection, select Azure DevOps OAuth 2.0, and follow the setup instructions (https://www.jetbrains.com/help/teamcity/configuring-connections.html#Azure+DevOps+OAuth+2.0+Connection).
2. Generate a token under Root project → VCS Auth Tokens, making it available to the required projects.
3. In both build features, select Refreshable access token and choose the generated token.
TeamCity then handles access-token renewal automatically, avoiding routine PAT updates across your build configurations. See Manage Refreshable Access Tokens (https://www.jetbrains.com/help/teamcity/manage-access-tokens.html).
Since you mentioned TFS, please also confirm whether you use Azure DevOps Services (cloud) or TFS/Azure DevOps Server (on-premises), including its version.
Hi, this is TFS On Premises, which Microsoft have mostly left to rot, it's currently DevOps Server 2022.2, but getting an upgraded soon to something newer. The available functionality for access tokens even in the newer version seems unchanged.
I will test again, and see if I can reproduce it, wondering if the type of field is important. We use Password, rather than plain text for the root parameter to hold our token.