Azure Pipelines "TF400813 / 401 Unauthorized" Error

By Daniel Zoghalchali·Latchkey

Azure DevOps rejected a request with TF400813 / 401 because the identity making it is not authorized for the resource.

What this error means

A step or REST/git call fails with "TF400813: The user is not authorized to access this resource" or a 401 Unauthorized.

TF400813: The user 'Build\\abc' is not authorized to access this resource.
remote: TF401019: The Git repository does not exist or you do not have permissions.

Common causes

Build service lacks permission

The project build-service identity is not granted access to the repo, feed, or resource.

Expired or wrong token

A PAT or system token is expired or scoped wrong.

Project-scoped identity

The identity cannot reach a cross-project resource.

How to fix it

Grant the build identity access

1. Add the project Build Service account to the resource with the needed permission.
2. For cross-project access, grant the org-level build service or use a PAT with correct scope.

Refresh the token/scope

1. Replace an expired PAT and confirm its scopes cover the operation.

How to prevent it

• Grant least-privilege access to the build service identity up front; this is a permissions problem, so retrying will not fix it.

Frequently asked questions

Related guides

References

• GitHub Actions documentation