-Tasks in a pipeline use either a [job access token](../../../docs/pipelines/process/access-tokens.md), available via the built-in variable [System.AccessToken](../../../docs/pipelines/process/variables.md#system-variables), or a PAT to access Azure DevOps resources. For instance, a “checkout” task uses this token to authenticate to the repository. Similarly, a PowerShell script can use this token to access Azure DevOps REST APIs. However, the permissions of this token are based on the Project Build Service identity, meaning all job access tokens in a project have identical permissions. This grants excessive access across all pipelines within the project.
0 commit comments