Limiting PAT Token permissions/scope?

[joseph-msft]

Customer may be hesitant to use Full Access PAT's. Is there documentation or can someone please provide a list of the required permissions/scope for a PAT Token for this tool? Assume migrating all available components that the processors can move.

[MrHinsh]

You need a Read only PAT for the Source as we never write to it.

You need a Full Access PAT for the Target. There are a number of access grants that are not available in the UX that we use. Specifically, we use the WorkItemStoreFlags.BypassRules which I don't believe can be used with anything other than a Full Acess PAT.

[dkaubar]

@MrHinsh can you please verify that?
when creating Azure DevOps PAT with with custom defined scopes and basically selecting first option (read, read/manage) on all (including expanded) scopes - tool results in 401 error:

Unhandled exception!
Microsoft.TeamFoundation.TeamFoundationServerUnauthorizedException: TF30063: You are not authorized to access https://dev.azure.com/{org}/. ---> System.Net.WebException: The remote server returned an error: (401) Unauthorized.

when running same configuration, just with full access PAT - it works.

It would be great to know which write/manage permission is needed and if there are any changes made to source?

[MrHinsh]

As per my comment above no changes are made to the source.

It would be great to know which write/manage permission is needed

The read/write permission required are only enabled with a "full access" PAT as they are not listed in the UX and are not enabled with "All". We are specifically looking for the BypassRules permission.

[dkaubar]

In that case saying that "You need a Read only PAT for the Source" is a bit misleading. while tool only reads from source it still needs Full Access PAT for Source to have BypassRules permission you mentioned

[MrHinsh]

That's something we can fix if that is what you are running into.