Azure DevOps Services Classic Release REST API requests started consistently failing starting on 2026-08-31

Affected endpoint host: https://vsrm.dev.azure.com Affected operations:

• GET /{project}/_apis/release/definitions?api-version=5.1
• GET /{project}/_apis/release/definitions?api-version=7.1
• GET /{project}/_apis/release/releases?api-version=5.1
• GET /{project}/_apis/release/folders?api-version=7.1

All return HTTP 500 with:

{
  "message": "Forbidden",
  "typeName": "Microsoft.VisualStudio.Services.Common.VssServiceException",
  "errorCode": 0,
  "eventId": 3000
}

Verified:

• Standard Azure DevOps APIs authenticate successfully with the same automation credential: Projects, Git, Build Definitions, Variable Groups, Agent Queues, and vsrm connectionData.
• The automation identity is an active Basic user and a direct Project Collection Administrators member.
• The standard Release Management permissions evaluate true, including View Release Definition, View Releases, and the full standard release mask.
• An explicit temporary PAT with Release read/write/execute/manage scope reproduced the same vsrm HTTP 500 Forbidden. It was revoked immediately after the test.
• The affected requests fail across multiple projects and API versions.
• The current Project Collection Administrator identity also receives HTTP 500 Forbidden for the same Classic Release requests.
• Release pipeline creation is enabled in the organization and tested projects.

Please investigate an Azure DevOps Services authorization or backend regression affecting Classic Release REST API access for authorized Project Collection Administrators. The response is a wrapped 500 rather than a normal authorization response, which prevents reliable automation diagnostics.