Azure Pipelines "TF400813: resource not authorized"

By Kaveh Alemi·Latchkey

TF400813 means the identity running the pipeline lacks permission for a resource it tried to access - usually the project build service account missing rights on a repo, work item, or another project.

What this error means

A step (git push back to the repo, a REST/API call, a cross-project access) fails with TF400813: The user <id> is not authorized to access this resource. The pipeline runs, but the identity is denied at the resource.

Azure DevOps

##[error]TF400813: The user 'Project Collection Build Service (org)'
is not authorized to access this resource.

Diagnose it: variables, expressions, or the agent?

Azure Pipelines resolves compile-time expressions (${{ }}) before the run and runtime expressions ($[ ]) during it. Using the wrong one is the most common source of a value that is empty when you read it.

azure-pipelines.yml

# print what the job actually resolved
- script: |
    echo "reason: $(Build.Reason)"
    echo "branch: $(Build.SourceBranch)"
    env | sort | head -40
  displayName: Dump context

# enable full diagnostics on a run: set system.debug = true as a variable

Common causes

Build service identity lacks permission

The pipeline runs as the project/collection Build Service account. If that identity has not been granted access to the target repo, area, or project, the resource denies it.

Insufficient job authorization scope or token

A restricted job authorization scope, or a System.AccessToken not exposed to the script, can leave the call without rights to a cross-project or protected resource.

How to fix it

Grant the build service the needed permission

Identify the resource (repo, project, area path) and the failing identity from the error.
In the resource’s Security settings, grant the Build Service account the required permission (e.g. Contribute for a git push-back).
For cross-project access, set the pipeline’s job authorization scope to project collection if intended.

Expose the access token to the script

Map System.AccessToken into the step so authenticated calls use the pipeline identity.

azure-pipelines.yml

steps:
  - script: |
      git push https://$(System.AccessToken)@dev.azure.com/...
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

How to prevent it

Grant the Build Service only the specific permissions each pipeline needs.
Set job authorization scope deliberately (project vs collection).
Expose System.AccessToken explicitly when scripts call Azure DevOps APIs.

Frequently asked questions

What causes Azure Pipelines "TF400813: resource not authorized"?

There are 2 common causes: build service identity lacks permission and insufficient job authorization scope or token. The pipeline runs as the project/collection Build Service account.

How do I fix Azure Pipelines "TF400813: resource not authorized"?

There are 2 fixes depending on which cause you have: grant the build service the needed permission and expose the access token to the script. Work through them in order, since the first is the most common.

What does Azure Pipelines "TF400813: resource not authorized" actually mean?

A step (git push back to the repo, a REST/API call, a cross-project access) fails with TF400813: The user <id> is not authorized to access this resource.

How do I stop Azure Pipelines "TF400813: resource not authorized" happening again?

Grant the Build Service only the specific permissions each pipeline needs. The prevention section lists 3 changes that keep it from recurring.

References

GitHub Actions documentation