Switch to using OAuth tokens (Azure Repos) and the MS auth broker by default - #2449
Open
mjcheetham wants to merge 3 commits into
Open
mjcheetham wants to merge 3 commits into
mjcheetham wants to merge 3 commits into
Conversation
mjcheetham
requested review from
dscho and
mpysson
and
a balanced review from Copilot
September 17, 2026 09:29
mjcheetham
added
host:azure-repos
There was a problem hiding this comment.
🟡 Changes recommended
Existing PAT-mode tests now follow the OAuth path, and the new defaults lack corresponding test updates.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Changes Azure Repos authentication defaults for GCM 3.0 and introduces cross-platform broker documentation.
Changes:
- Defaults Azure Repos to OAuth tokens and enables broker authentication.
- Retains configuration options for PAT and brokerless authentication.
- Replaces Windows-only broker guidance with cross-platform documentation.
File summaries
| File | Description |
|---|---|
src/Microsoft.AzureRepos/AzureReposHostProvider.cs |
Defaults Azure Repos credentials to OAuth. |
src/Core/Authentication/Entra/EntraAuthentication.PublicClient.cs |
Enables the OS authentication broker by default. |
README.md |
Advertises cross-platform broker support. |
docs/windows-broker.md |
Removes superseded Windows-only documentation. |
docs/msauth-broker.md |
Adds cross-platform broker guidance. |
docs/environment.md |
Documents updated environment-variable defaults. |
docs/configuration.md |
Documents updated Git configuration defaults. |
docs/azrepos-users-and-tokens.md |
Updates Entra ID terminology. |
Review details
Suppressed comments (2)
docs/msauth-broker.md:140
- “Sign in” is a verb and should not be hyphenated here.
> If you are using local accounts on Windows, when you first sign-in to a
docs/msauth-broker.md:145
- The extra breadcrumb separator makes this read “Your info > and select.” Remove it before the instruction.
from the Settings app: [**Accounts** > **Your info**][appx-settings-yourinfo] >
- Files reviewed: 8/19 changed files
- Comments generated: 11
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mjcheetham
force-pushed
the
azrepos-newauth-default
branch
2 times, most recently
from
September 17, 2026 09:39
1431a4c to
86bdec6
Compare
Change the default from PAT to OAuth bearer token credentials for Azure Repos. Also update the documentation references to "AAD" to "Entra ID" following the rename by Microsoft. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Change the default option for the MS authentication broker to 'enabled' on all platforms and environments. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Update the "WAM/Windows broker" docs to now cover the Microsoft authentication broker on all OSes (Windows, Mac, Linux). Include new features, updated screenshots, and information about device join and how to disconnect. Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
mjcheetham
force-pushed
the
azrepos-newauth-default
branch
from
September 17, 2026 09:57
86bdec6 to
20fa90c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the defaults for the Azure Repos credential type and Microsoft authentication broker enabled to
oauthandtruerespectively. With the new GCM major version bump to 3.x, along with the new Entra 1st party application and Mac & Linux broker support, we are ready to adopt these by default.The settings remain for those that need to revert back to
patand broker-less (false) auth.Finally we update the documentation for the broker with new images, behaviour, and updated sections for Mac and Linux:
Rendered broker docs