Azure Pipelines "TF400813 / 401 Unauthorized" Error

By Daniel Zoghalchali·Latchkey

Azure DevOps rejected a request with TF400813 / 401 because the identity making it is not authorized for the resource.

What this error means

A step or REST/git call fails with "TF400813: The user is not authorized to access this resource" or a 401 Unauthorized.

azure-pipelines

TF400813: The user 'Build\\abc' is not authorized to access this resource.
remote: TF401019: The Git repository does not exist or you do not have permissions.

Diagnose it: variables, expressions, or the agent?

Azure Pipelines resolves compile-time expressions (${{ }}) before the run and runtime expressions ($[ ]) during it. Using the wrong one is the most common source of a value that is empty when you read it.

azure-pipelines.yml

# print what the job actually resolved
- script: |
    echo "reason: $(Build.Reason)"
    echo "branch: $(Build.SourceBranch)"
    env | sort | head -40
  displayName: Dump context

# enable full diagnostics on a run: set system.debug = true as a variable

Common causes

Build service lacks permission

The project build-service identity is not granted access to the repo, feed, or resource.

Expired or wrong token

A PAT or system token is expired or scoped wrong.

Project-scoped identity

The identity cannot reach a cross-project resource.

How to fix it

Grant the build identity access

Add the project Build Service account to the resource with the needed permission.
For cross-project access, grant the org-level build service or use a PAT with correct scope.

Refresh the token/scope

Replace an expired PAT and confirm its scopes cover the operation.

How to prevent it

Grant least-privilege access to the build service identity up front; this is a permissions problem, so retrying will not fix it.

Frequently asked questions

What causes Azure Pipelines "TF400813 / 401 Unauthorized" error?

There are 3 common causes: build service lacks permission, expired or wrong token, and project-scoped identity. The project build-service identity is not granted access to the repo, feed, or resource.

How do I fix Azure Pipelines "TF400813 / 401 Unauthorized" error?

There are 2 fixes depending on which cause you have: grant the build identity access and refresh the token/scope. Work through them in order, since the first is the most common.

What does Azure Pipelines "TF400813 / 401 Unauthorized" error actually mean?