What is the subjectDescriptor in the Personal Access Token API for Azure

Question

I am trying to write a script to automate some aspects of our Azure DevOps environment but I am struggling to be able to return the PAT's for a specific user to be able to authorize them to execute API calls. Would someone be able to give me an example of what the subjectDescriptor is and where I can find it? I have read through microsoft's documentation but it is not very helpful in this and I could not find an example of what value should be passed into subjectDescriptor for the GET request.

Basically what I am trying to do is write a powershell script that a user has to authenticate into and then the script will pull their PAT's and execute API calls based on the access that the user has.

Answer 1

What the subjectDescriptor is and where I can find it?

In the security of Azure Devops, subjectDescriptor is user's SID. It used as identification when operating some security control. This parameter can uniquely identify the same graph subject across both Accounts and Organizations.

To get it, just use the following API:

GET https://vssps.dev.azure.com/{org name}/_apis/graph/users?api-version=5.1-preview.1

From its response body, you can get the descriptor value of corresponding user.

Next, you can pass the corresponding descriptor value into the list PAT token API.

---

In addition, you can also due to this blog which written by our engineer.