Azure DevOps is moving some auth flows to Entra token issuance this summer, so token payloads will stop being readable by clients.
The exact mechanism isn’t specified (JWE would be my guess), but anything decoding tokens to read claims like UPN or tenant ID will break — no graceful degradation.
Most likely to hit internal tooling and scripts, but worth a check either way.
Supported path: Azure DevOps REST APIs for user and org data.
https://devblogs.microsoft.com/devops/authentication-tokens-are-not-a-data-contract/

Authentication Tokens Are Not a Data Contract - Azure DevOps Blog
Authentication tokens exist to answer one question: is this caller authorized to do this? They are not intended to be a stable data interface, a schema you can depend on, or an input into application logic. If your application decodes tokens and reads claims from them, this is an important heads-up. Token Claims Were Never […]


